From 65ee84c6edca2f9745eda8fce5909481bd688d7a Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 23 Jul 2026 17:20:27 +0530 Subject: [PATCH 001/127] fix: #302 Add isolated esignet-standalone-2.0.0 Helmsman profile that can be deployed side-by-side with the existing esignet-standalone profile without colliding on namespaces, releases, hostnames, or databases. Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 20 +- .github/workflows/helmsman_signup.yml | 1 + .github/workflows/helmsman_testrigs.yml | 11 +- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 661 ++++++++++++++++++ .../esignet-standalone-2.0.0/signup-dsf.yaml | 185 +++++ .../testrigs-dsf.yaml | 276 ++++++++ .../dsf/esignet-standalone/external-dsf.yaml | 85 +++ .../apitestrig-esignet-mosipid1-setup.sh | 27 + .../apitestrig-esignet-mosipid2-setup.sh | 27 + .../apitestrig-esignet-setup.sh | 27 + .../apitestrig-esignet-sunbird-setup.sh | 27 + .../apitestrig-signup-setup.sh | 27 + .../captcha-postinstall.sh | 56 ++ .../config-server-esignet-postinstall.sh | 39 ++ .../config-server-esignet-setup.sh | 78 +++ .../esignet-db-postinstall.sh | 23 + .../esignet-init-db.sh | 24 + .../esignet-misp-onboarder-postinstall.sh | 52 ++ .../esignet-misp-onboarder-preinstall.sh | 46 ++ .../esignet-mock-rp-onboarder-postinstall.sh | 41 ++ .../esignet-mock-rp-onboarder-preinstall.sh | 37 + .../esignet-mosipid1-preinstall.sh | 127 ++++ .../esignet-mosipid2-preinstall.sh | 127 ++++ .../esignet-postinstall-keycloak-init.sh | 32 + .../esignet-preinstall-keycloak-init.sh | 51 ++ .../esignet-preinstall.sh | 62 ++ .../esignet-sunbird-preinstall.sh | 64 ++ .../kafka-postinstall.sh | 28 + .../kernel-preinstall.sh | 44 ++ .../keycloak-postinstall.sh | 103 +++ .../mock-identity-init-db.sh | 30 + .../mock-identity-system-preinstall.sh | 61 ++ ...lying-party-service-mosipid1-preinstall.sh | 10 + ...lying-party-service-mosipid2-preinstall.sh | 10 + .../mock-relying-party-service-preinstall.sh | 73 ++ ...elying-party-service-sunbird-preinstall.sh | 10 + ...ck-relying-party-ui-mosipid1-preinstall.sh | 24 + ...ck-relying-party-ui-mosipid2-preinstall.sh | 24 + .../mock-relying-party-ui-preinstall.sh | 23 + ...ock-relying-party-ui-sunbird-preinstall.sh | 24 + .../notifier-postinstall.sh | 22 + .../oidc-ui-mosipid1-preinstall.sh | 9 + .../oidc-ui-mosipid2-preinstall.sh | 9 + .../oidc-ui-preinstall.sh | 34 + .../oidc-ui-sunbird-preinstall.sh | 9 + .../pms-partner-mosipid1-preinstall.sh | 45 ++ .../pms-partner-mosipid2-preinstall.sh | 45 ++ .../postgres-postinstall.sh | 40 ++ .../postgres-preinstall.sh | 32 + .../esignet-standalone-2.0.0/redis-setup.sh | 50 ++ .../signup-init-db.sh | 31 + .../signup-keycloak-init-postinstall.sh | 44 ++ .../signup-keycloak-init-preinstall.sh | 59 ++ .../signup-service-preinstall.sh | 95 +++ .../softhsm-esignet-mosipid1-setup.sh | 9 + .../softhsm-esignet-mosipid2-setup.sh | 9 + .../softhsm-esignet-postinstall.sh | 38 + .../softhsm-esignet-setup.sh | 29 + .../softhsm-esignet-sunbird-setup.sh | 9 + ...ofthsm-mock-identity-system-postinstall.sh | 27 + ...softhsm-mock-identity-system-preinstall.sh | 17 + .../trigger-test-jobs-esignet.sh | 92 +++ .../uitestrig-signup-setup.sh | 34 + docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 8 + 64 files changed, 3481 insertions(+), 12 deletions(-) create mode 100644 Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml create mode 100644 Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml create mode 100644 Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall-keycloak-init.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/postgres-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/signup-init-db.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 6410ee885..4603e6237 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -12,6 +12,7 @@ on: - mosip-platform-1.2.0.x - mosip-platform-1.2.1.x - esignet-standalone + - esignet-standalone-2.0.0 mode: description: "Choose Helmsman mode: dry-run or apply" required: true @@ -90,7 +91,7 @@ jobs: echo "✓ esignet_db_port = $ESIGNET_DB_PORT" # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. # Push events always target esignet (path filter); dispatch uses explicit profile input. - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then + if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" @@ -325,7 +326,7 @@ jobs: kubectl cluster-info - name: Check if mosip-dsf label is completed - if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && github.event.inputs.profile != 'esignet-standalone' }} + if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(github.event.inputs.profile, 'esignet-standalone') }} run: | STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.mosip-dsf}' 2>/dev/null || echo "") if [[ "$STATUS" != "completed" ]]; then @@ -380,7 +381,7 @@ jobs: fi # Per-namespace captcha secrets — only required for esignet standalone profile - if [ "$PROFILE" = "esignet-standalone" ]; then + if [[ "$PROFILE" == esignet-standalone* ]]; then echo "--- Validating esignet standalone mosipid1 captcha secrets ---" for var in ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY \ ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do @@ -431,7 +432,7 @@ jobs: echo " - MOCK_RELYING_PARTY_JWE_PRIVATE_KEY (base64 encoded PEM)" echo " - ESIGNET_CAPTCHA_SITE_KEY (reCAPTCHA site key - plain text)" echo " - ESIGNET_CAPTCHA_SECRET_KEY (reCAPTCHA secret key - plain text)" - if [ "$PROFILE" = "esignet-standalone" ]; then + if [[ "$PROFILE" == esignet-standalone* ]]; then echo " - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY" echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" echo " - MOSIPID1_POSTGRES_PASSWORD / MOSIPID1_KEYCLOAK_ADMIN_PASSWORD" @@ -472,7 +473,7 @@ jobs: fi - name: Get MinIO root password - if: ${{ env.PROFILE == 'esignet-standalone' }} + if: ${{ startsWith(env.PROFILE, 'esignet-standalone') }} run: | MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' | base64 -d) if [ -n "$MINIO_ROOT_PASSWORD" ]; then @@ -579,9 +580,14 @@ jobs: # they read the new PIN but the PVC token has the old one → CKR_PIN_INCORRECT. # Fix: skip softhsm upgrade on re-runs so the PIN in the secret never changes. SKIP_RELEASES_ARG="" - if [ "$PROFILE" = "esignet-standalone" ]; then + if [[ "$PROFILE" == esignet-standalone* ]]; then + case "$PROFILE" in + esignet-standalone) NS_SUFFIX="" ;; + esignet-standalone-2.0.0) NS_SUFFIX="-2-0-0" ;; + *) NS_SUFFIX="" ;; + esac SKIP_RELEASES="" - for pair in "esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid1:esignet-mosipid1" "esignet-softhsm-mosipid2:esignet-mosipid2" "esignet-softhsm-sunbird:esignet-sunbird"; do + for pair in "esignet-softhsm${NS_SUFFIX}:esignet-mock${NS_SUFFIX}" "esignet-softhsm-mosipid1${NS_SUFFIX}:esignet-mosipid1${NS_SUFFIX}" "esignet-softhsm-mosipid2${NS_SUFFIX}:esignet-mosipid2${NS_SUFFIX}" "esignet-softhsm-sunbird${NS_SUFFIX}:esignet-sunbird${NS_SUFFIX}"; do release="${pair%%:*}" ns="${pair##*:}" if helm status "$release" -n "$ns" &>/dev/null; then diff --git a/.github/workflows/helmsman_signup.yml b/.github/workflows/helmsman_signup.yml index 5322df2e0..ff770b1ff 100644 --- a/.github/workflows/helmsman_signup.yml +++ b/.github/workflows/helmsman_signup.yml @@ -10,6 +10,7 @@ on: type: choice options: - esignet-standalone + - esignet-standalone-2.0.0 - mosip-platform-1.2.0.x - mosip-platform-1.2.1.x mode: diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 63aa58462..3aa92a77d 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -12,6 +12,7 @@ on: - mosip-platform-1.2.0.x - mosip-platform-1.2.1.x - esignet-standalone + - esignet-standalone-2.0.0 mode: description: "Choose Helmsman mode: dry-run or apply" required: true @@ -80,7 +81,7 @@ jobs: [ -z "$SLACK_CH" ] && errors+=("slack_channel_name is empty — set vars.SLACK_CHANNEL_NAME under Environment '${{ github.ref_name }}'") [ -z "$DB_PORT" ] && errors+=("db_port is empty — set vars.DB_PORT under Environment '${{ github.ref_name }}'") [ -z "$ESIGNET_DB_PORT" ] && errors+=("esignet_db_port is empty — set vars.ESIGNET_DB_PORT under Environment '${{ github.ref_name }}'") - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then + if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" [ -z "$MOSIPID1_DOMAIN" ] && errors+=("mosipid1_domain_name is empty — set vars.MOSIPID1_DOMAIN_NAME under Environment '${{ github.ref_name }}'") @@ -97,7 +98,7 @@ jobs: echo "✓ slack_channel_name = $SLACK_CH" echo "✓ db_port = $DB_PORT" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then + if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet profile)" echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet profile)" fi @@ -276,7 +277,7 @@ jobs: kubectl get nodes kubectl cluster-info - name: Get MinIO root password (esignet profile) - if: env.PROFILE == 'esignet-standalone' + if: startsWith(env.PROFILE, 'esignet-standalone') run: | if kubectl -n minio get secret minio &>/dev/null; then MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' | base64 -d) @@ -292,7 +293,7 @@ jobs: fi - name: Check if mosip-dsf label is completed - if: env.PROFILE != 'esignet-standalone' + if: ${{ !startsWith(env.PROFILE, 'esignet-standalone') }} run: | STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.mosip-dsf}') if [[ "$STATUS" != "completed" ]]; then @@ -301,7 +302,7 @@ jobs: fi - name: Check if esignet-dsf label is completed - if: env.PROFILE == 'esignet-standalone' + if: startsWith(env.PROFILE, 'esignet-standalone') run: | STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.esignet-dsf}' 2>/dev/null || echo "") if [[ "$STATUS" != "completed" ]]; then diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml new file mode 100644 index 000000000..1e786dd10 --- /dev/null +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -0,0 +1,661 @@ +# ============================================================================= +# eSignet Profile - eSignet Services DSF (Desired State File) +# ============================================================================= +# This DSF deploys eSignet v1.7.1 services for the standalone eSignet profile. +# +# Components (in priority order): +# 1. Keycloak Init (eSignet-specific clients and roles) +# 2. eSignet service v1.7.1 +# 3. OIDC UI v1.7.1 +# 4. Mock Identity System (optional, disabled by default) +# 5. Mock Relying Party Service (optional) +# 6. Mock Relying Party UI (optional) +# 7. Partner Onboarder (eSignet + Resident OIDC) +# 8. Demo OIDC Partner Onboarder +# +# Based on eSignet v1.7.1 deploy scripts: +# - install-esignet.sh +# - initialise-prereq.sh (keycloak-init) +# ============================================================================= + +helmDefaults: + tillerNamespace: kube-system + tillerless: true + install: true + +helmRepos: + bitnami: https://charts.bitnami.com/bitnami + mosip: https://mosip.github.io/mosip-helm + +namespaces: + esignet-mock-2-0-0: + protected: false + softhsm-2-0-0: + protected: false + esignet-mosipid1-2-0-0: + protected: false + esignet-mosipid2-2-0-0: + protected: false + esignet-sunbird-2-0-0: + protected: false + +apps: + # --------------------------------------------------------------------------- + # SoftHSM for eSignet + # --------------------------------------------------------------------------- + # Deployed here (not in external-dsf) so esignet-softhsm-share configmap is + # available in esignet namespace before eSignet service starts. + esignet-softhsm-2-0-0: + namespace: esignet-mock-2-0-0 + enabled: true + version: 12.0.1 + chart: mosip/softhsm + valuesFile: "$WORKDIR/utils/softhsm-esignet-values.yaml" + timeout: 480 + priority: -16 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" + + esignet-softhsm-mosipid1-2-0-0: + namespace: esignet-mosipid1-2-0-0 + enabled: true + version: 12.0.1 + chart: mosip/softhsm + valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid1-values.yaml" + timeout: 480 + priority: -16 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh" + + esignet-softhsm-mosipid2-2-0-0: + namespace: esignet-mosipid2-2-0-0 + enabled: ${MOSIPID2_ENABLED} + version: 12.0.1 + chart: mosip/softhsm + valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid2-values.yaml" + timeout: 480 + priority: -16 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh" + + esignet-softhsm-sunbird-2-0-0: + namespace: esignet-sunbird-2-0-0 + enabled: true + version: 12.0.1 + chart: mosip/softhsm + valuesFile: "$WORKDIR/utils/softhsm-esignet-sunbird-values.yaml" + timeout: 480 + priority: -16 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh" + + esignet-config-server-2-0-0: + namespace: esignet-mock-2-0-0 + enabled: false + version: 12.0.1 + chart: mosip/config-server + valuesFile: "$WORKDIR/utils/config-server-esignet-values.yaml" + wait: true + timeout: 1200 + priority: -15 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh" + + # --------------------------------------------------------------------------- + # eSignet v1.7.1 + # --------------------------------------------------------------------------- + esignet-mock-2-0-0: + namespace: esignet-mock-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/esignet + valuesFile: "$WORKDIR/utils/esignet-plugin-values.yaml" + set: + image.repository: "mosipqa/esignet-with-plugins" + image.tag: "develop" + enable_insecure: "false" + springConfigNameEnv: "" + activeProfileEnv: "" + pluginNameEnv: "esignet-mock-plugin.jar" + pluginUrlEnv: "" + extraEnvVarsCM[0]: "esignet-softhsm-share" + #extraEnvVarsCM[1]: "kafka-config" + metrics.serviceMonitor.enabled: "false" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-2-0-0.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-2-0-0.${domain_name}" + domainConfig.MOSIP_API_HOST: "api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" + domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp-2-0-0.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + timeout: 600 + priority: -14 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" + + esignet-mosipid1-2-0-0: + namespace: esignet-mosipid1-2-0-0 + enabled: true + version: 0.1.0-develop + chart: mosip/esignet + valuesFile: "$WORKDIR/utils/esignet-mosipid1-plugin-values.yaml" + set: + image.repository: "mosipqa/esignet-with-plugins" + image.tag: "develop" + enable_insecure: "false" + springConfigNameEnv: "" + activeProfileEnv: "" + pluginNameEnv: "mosip-identity-plugin.jar" + pluginUrlEnv: "" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid1-share" + extraEnvVarsCM[1]: "esignet-global" + metrics.serviceMonitor.enabled: "false" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid1-2-0-0.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid1-2-0-0.${domain_name}" + domainConfig.MOSIP_API_HOST: "api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" + domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp-2-0-0.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid1_domain_name}" + domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid1_domain_name}" + domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid1_domain_name}/mosip-certs/ida-partner.cer" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid1_domain_name}/v1/authmanager/authenticate/clientidsecretkey" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid1_domain_name}/v1/auditmanager/audits" + domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid1-2-0-0.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid1-2-0-0.${domain_name}" + timeout: 600 + priority: -14 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh" + + esignet-mosipid2-2-0-0: + namespace: esignet-mosipid2-2-0-0 + enabled: ${MOSIPID2_ENABLED} + version: 0.0.1-develop + chart: mosip/esignet + valuesFile: "$WORKDIR/utils/esignet-mosipid2-plugin-values.yaml" + set: + image.repository: "mosipqa/esignet-with-plugins" + image.tag: "develop" + enable_insecure: "false" + springConfigNameEnv: "" + activeProfileEnv: "" + pluginNameEnv: "mosip-identity-plugin.jar" + pluginUrlEnv: "" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid2-share" + extraEnvVarsCM[1]: "esignet-global" + metrics.serviceMonitor.enabled: "false" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid2-2-0-0.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid2-2-0-0.${domain_name}" + domainConfig.MOSIP_API_HOST: "api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" + domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" + domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp-2-0-0.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid2_domain_name}" + domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid2_domain_name}" + domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid2_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid2_domain_name}/mosip-certs/ida-partner.cer" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid2_domain_name}/v1/authmanager/authenticate/clientidsecretkey" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid2_domain_name}/v1/auditmanager/audits" + domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid2-2-0-0.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid2-2-0-0.${domain_name}" + timeout: 600 + priority: -14 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh" + + esignet-sunbird-2-0-0: + namespace: esignet-sunbird-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/esignet + valuesFile: "$WORKDIR/utils/esignet-sunbird-plugin-values.yaml" + set: + image.repository: "mosipqa/esignet-with-plugins" + image.tag: "develop" + enable_insecure: "false" + springConfigNameEnv: "" + activeProfileEnv: "" + pluginNameEnv: "sunbird-rc-plugin.jar" + pluginUrlEnv: "" + extraEnvVarsCM[0]: "esignet-softhsm-sunbird-share" + #extraEnvVarsCM[1]: "kafka-config" + metrics.serviceMonitor.enabled: "false" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-sunbird-2-0-0.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-sunbird-2-0-0.${domain_name}" + domainConfig.MOSIP_API_HOST: "api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" + domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp-2-0-0.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" + timeout: 600 + priority: -14 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh" + + # --------------------------------------------------------------------------- + # OIDC UI v1.7.1 + # --------------------------------------------------------------------------- + oidc-ui-2-0-0: + namespace: esignet-mock-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/oidc-ui + set: + image.repository: "mosipqa/oidc-ui" + image.tag: "develop" + istio.hosts[0]: "esignet-2-0-0.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mock-2-0-0.esignet-mock-2-0-0" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mock-2-0-0.esignet-mock-2-0-0/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mock-2-0-0.esignet-mock-2-0-0" + timeout: 1200 + priority: -13 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" + + oidc-ui-mosipid1-2-0-0: + namespace: esignet-mosipid1-2-0-0 + enabled: true + version: 0.1.0-develop + chart: mosip/oidc-ui + set: + image.repository: "mosipqa/oidc-ui" + image.tag: "develop" + istio.hosts[0]: "esignet-mosipid1-2-0-0.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mosipid1-2-0-0.esignet-mosipid1-2-0-0" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid1-2-0-0.esignet-mosipid1-2-0-0/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid1-2-0-0.esignet-mosipid1-2-0-0" + timeout: 1200 + priority: -13 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh" + + oidc-ui-mosipid2-2-0-0: + namespace: esignet-mosipid2-2-0-0 + enabled: ${MOSIPID2_ENABLED} + version: 0.0.1-develop + chart: mosip/oidc-ui + set: + image.repository: "mosipqa/oidc-ui" + image.tag: "develop" + istio.hosts[0]: "esignet-mosipid2-2-0-0.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mosipid2-2-0-0.esignet-mosipid2-2-0-0" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid2-2-0-0.esignet-mosipid2-2-0-0/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid2-2-0-0.esignet-mosipid2-2-0-0" + timeout: 1200 + priority: -13 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh" + + oidc-ui-sunbird-2-0-0: + namespace: esignet-sunbird-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/oidc-ui + set: + image.repository: "mosipqa/oidc-ui" + image.tag: "1.8.x" + istio.hosts[0]: "esignet-sunbird-2-0-0.${domain_name}" + oidc_ui.oidc_service_host: "esignet-sunbird-2-0-0.esignet-sunbird-2-0-0" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-sunbird-2-0-0.esignet-sunbird-2-0-0/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-sunbird-2-0-0.esignet-sunbird-2-0-0" + timeout: 1200 + priority: -13 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh" + + # --------------------------------------------------------------------------- + # Mock Identity System (Optional) + # --------------------------------------------------------------------------- + # Enable for testing with mock identity data. + softhsm-mock-identity-system-2-0-0: + namespace: softhsm-2-0-0 + enabled: true + version: 12.0.1 + chart: mosip/softhsm + valuesFile: "$WORKDIR/utils/softhsm-mock-identity-system-values.yaml" + wait: true + timeout: 480 + priority: -12 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh" + + mock-identity-system-2-0-0: + namespace: esignet-mock-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/mock-identity-system + valuesFile: "$WORKDIR/utils/mock-identity-values.yaml" + set: + image.repository: "mosipqa/mock-identity-system" + image.tag: "develop" + enable_insecure: "false" + extraEnvVarsCM[0]: "softhsm-mock-identity-system-share" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-2-0-0.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-2-0-0.${domain_name}" + domainConfig.MOSIP_API_HOST: "api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" + domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp-2-0-0.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + domainConfig.MOSIP_MOCK_IDA_IDENTITY_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/email-signup-schema-testing.json" + domainConfig.MOSIP_MOCK_UI_SPEC_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/ui_spec_reset_password_phone.json" + timeout: 480 + priority: -11 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh" + + # --------------------------------------------------------------------------- + # Mock Relying Party (Optional) + # --------------------------------------------------------------------------- + mock-relying-party-service-2-0-0: + namespace: esignet-mock-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/mock-relying-party-service + set: + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mock-2-0-0.esignet-mock-2-0-0/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-2-0-0.${domain_name}/v1/esignet/oauth/v2/token" + enable_insecure: "false" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + timeout: 480 + priority: -10 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" + + mock-relying-party-service-mosipid1-2-0-0: + namespace: esignet-mosipid1-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/mock-relying-party-service + set: + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid1-2-0-0.esignet-mosipid1-2-0-0/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid1-2-0-0.${domain_name}/v1/esignet/oauth/v2/token" + enable_insecure: "false" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + timeout: 480 + priority: -10 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh" + + mock-relying-party-service-mosipid2-2-0-0: + namespace: esignet-mosipid2-2-0-0 + enabled: ${MOSIPID2_ENABLED} + version: 0.0.1-develop + chart: mosip/mock-relying-party-service + set: + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid2-2-0-0.esignet-mosipid2-2-0-0/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid2-2-0-0.${domain_name}/v1/esignet/oauth/v2/token" + enable_insecure: "false" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + timeout: 480 + priority: -10 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh" + + mock-relying-party-service-sunbird-2-0-0: + namespace: esignet-sunbird-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/mock-relying-party-service + set: + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-sunbird-2-0-0.esignet-sunbird-2-0-0/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-sunbird-2-0-0.${domain_name}/v1/esignet/oauth/v2/token" + enable_insecure: "false" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + timeout: 480 + priority: -10 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh" + + mock-relying-party-ui-2-0-0: + namespace: esignet-mock-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/mock-relying-party-ui + set: + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-2-0-0.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-2-0-0.esignet-mock-2-0-0" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-2-0-0.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-2-0-0.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-2-0-0.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-2-0-0.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-2-0-0.${domain_name}/plugins/sign-in-button-plugin.js" + istio.hosts[0]: "healthservices-2-0-0.${domain_name}" + wait: true + timeout: 480 + priority: -9 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh" + + mock-relying-party-ui-mosipid1-2-0-0: + namespace: esignet-mosipid1-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/mock-relying-party-ui + set: + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid1-2-0-0.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid1-2-0-0.esignet-mosipid1-2-0-0" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid1-2-0-0.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid1-2-0-0.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1-2-0-0.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1-2-0-0.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1-2-0-0.${domain_name}/plugins/sign-in-button-plugin.js" + istio.hosts[0]: "healthservices-mosipid1-2-0-0.${domain_name}" + wait: true + timeout: 480 + priority: -9 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh" + + mock-relying-party-ui-mosipid2-2-0-0: + namespace: esignet-mosipid2-2-0-0 + enabled: ${MOSIPID2_ENABLED} + version: 0.0.1-develop + chart: mosip/mock-relying-party-ui + set: + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid2-2-0-0.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid2-2-0-0.esignet-mosipid2-2-0-0" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid2-2-0-0.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid2-2-0-0.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2-2-0-0.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2-2-0-0.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2-2-0-0.${domain_name}/plugins/sign-in-button-plugin.js" + istio.hosts[0]: "healthservices-mosipid2-2-0-0.${domain_name}" + wait: true + timeout: 480 + priority: -9 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh" + + mock-relying-party-ui-sunbird-2-0-0: + namespace: esignet-sunbird-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/mock-relying-party-ui + set: + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-sunbird-2-0-0.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-sunbird-2-0-0.esignet-sunbird-2-0-0" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-sunbird-2-0-0.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-sunbird-2-0-0.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird-2-0-0.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird-2-0-0.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird-2-0-0.${domain_name}/plugins/sign-in-button-plugin.js" + istio.hosts[0]: "healthservices-sunbird-2-0-0.${domain_name}" + wait: true + timeout: 480 + priority: -9 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh" + + pms-partner-mosipid1-2-0-0: + namespace: esignet-mosipid1-2-0-0 + enabled: false + version: 12.2.3 + chart: mosip/pms-partner + set: + # image.repository: "mosipid/partner-management-service" + # image.tag: "1.2.2.3" + istio.gateways[0]: "pms-partner-mosipid1-gateway" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1-2-0-0.${domain_name}" + extraEnvVarsCM[0]: "esignet-global" + extraEnvVarsCM[1]: "esignet-config-server-share" + priority: -9 + timeout: 1200 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh" + + pms-policy-mosipid1-2-0-0: + namespace: esignet-mosipid1-2-0-0 + enabled: false + version: 12.2.3 + chart: mosip/pms-policy + set: + # image.repository: "mosipid/policy-management-service" + # image.tag: "1.2.2.2" + istio.gateways[0]: "pms-partner-mosipid1-gateway" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1-2-0-0.${domain_name}" + extraEnvVarsCM[0]: "esignet-global" + extraEnvVarsCM[1]: "esignet-config-server-share" + priority: -9 + timeout: 1200 + + pms-partner-mosipid2-2-0-0: + namespace: esignet-mosipid2-2-0-0 + enabled: false + version: 12.2.3 + chart: mosip/pms-partner + set: + # image.repository: "mosipid/partner-management-service" + # image.tag: "1.2.2.3" + istio.gateways[0]: "pms-partner-mosipid2-gateway" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2-2-0-0.${domain_name}" + extraEnvVarsCM[0]: "esignet-global" + extraEnvVarsCM[1]: "esignet-config-server-share" + priority: -9 + timeout: 1200 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh" + + pms-policy-mosipid2-2-0-0: + namespace: esignet-mosipid2-2-0-0 + enabled: false + version: 12.2.3 + chart: mosip/pms-policy + set: + # image.repository: "mosipid/policy-management-service" + # image.tag: "1.2.2.2" + istio.gateways[0]: "pms-partner-mosipid2-gateway" + extraEnvVarsCM[0]: "esignet-global" + extraEnvVarsCM[1]: "esignet-config-server-share" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2-2-0-0.${domain_name}" + priority: -9 + timeout: 1200 + + # --------------------------------------------------------------------------- + # Partner Onboarders + # --------------------------------------------------------------------------- + # Two onboarders for eSignet standalone — enable the one matching your plugin: + # esignet-mock-rp-onboarder: for mock plugin (plugin 1) and sunbird-rc (plugin 3) + # esignet-misp-onboarder: for mosip-identity-plugin (plugin 2) only + + # eSignet MISP Partner Onboarder + # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). + # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. + # After completion, restarts the esignet deployment to pick up the new MISP license key. + esignet-misp-onboarder-2-0-0: + namespace: esignet-mock-2-0-0 + enabled: false + version: 0.0.1-develop + chart: mosip/partner-onboarder + set: + onboarding.modules[0].name: "esignet" + onboarding.modules[0].enabled: "true" + onboarding.configmaps.s3.s3-host: "http://minio.minio:9000" + onboarding.configmaps.s3.s3-user-key: "admin" + onboarding.configmaps.s3.s3-region: "" + onboarding.configmaps.s3.s3-bucket-name: "onboarder" + onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock-2-0-0" + onboarding.variables.push_reports_to_s3: "true" + onboarding.variables.mosipid: "false" + extraEnvVarsCM[0]: "keycloak-env-vars" + extraEnvVarsCM[1]: "keycloak-host" + extraEnvVarsSecret[0]: "keycloak" + extraEnvVarsSecret[1]: "keycloak-client-secrets" + domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" + domainConfig.mosip-api-host: "api.${domain_name}" + domainConfig.mosip-esignet-host: "esignet-2-0-0.${domain_name}" + domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" + domainConfig.mosip-resident-host: "resident.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + wait: true + waitForJobs: true + timeout: 600 + priority: -6 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh" + + # Mock RP OIDC Partner Onboarder + # Onboards the mock relying party as an OIDC client. + # Enable for plugin 1 (mock) or plugin 3 (sunbird-rc). Set mosipid: "true" for mosip-identity-plugin. + esignet-mock-rp-onboarder-2-0-0: + namespace: esignet-mock-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/partner-onboarder + set: + image.repository: "mosipid/partner-onboarder" + image.tag: "1.3.0-beta.1" + onboarding.modules[0].name: "mock-rp-oidc" + onboarding.modules[0].enabled: "true" + onboarding.configmaps.s3.s3-host: "http://minio.minio:9000" + onboarding.configmaps.s3.s3-user-key: "admin" + onboarding.configmaps.s3.s3-region: "" + onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" + onboarding.configmaps.s3.s3-bucket-name: "onboarder" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock-2-0-0" + onboarding.variables.mosipid: "false" + onboarding.variables.push_reports_to_s3: "true" + extraEnvVarsCM[0]: "keycloak-env-vars" + extraEnvVarsCM[1]: "keycloak-host" + domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" + domainConfig.mosip-api-host: "api.${domain_name}" + domainConfig.mosip-esignet-host: "esignet-2-0-0.${domain_name}" + domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" + domainConfig.mosip-resident-host: "resident.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + wait: true + waitForJobs: true + timeout: 600 + priority: -5 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh" diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml new file mode 100644 index 000000000..8ca5b652d --- /dev/null +++ b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml @@ -0,0 +1,185 @@ +# ============================================================================= +# eSignet Profile - Signup Services DSF (Desired State File) +# ============================================================================= +# This DSF deploys signup-service and its dependencies on top of the +# standalone eSignet profile. All apps are disabled by default — enable as +# needed alongside external-dsf.yaml (which provides postgres-init-signup). +# +# Prerequisites (from external-dsf.yaml): +# - postgres-init-signup enabled (mosip_audit, mosip_kernel, mosip_otp) +# - Redis, Kafka, Keycloak + keycloak-postinstall (keycloak-client-secrets) +# - Captcha (for signup captcha validation) +# +# Components (in priority order): +# 1. Signup Keycloak Init — mosip-signup-client roles and client secret +# 2. Kernel services — authmanager, auditmanager, otpmanager, notifier +# 3. Mock SMTP — for dev/test email/SMS (optional) +# 4. Signup service — signup-service with esignet-mock-plugin.jar +# 5. Signup UI — signup-ui +# +# Based on eSignet signup deploy scripts: +# - deploy/prereq.sh +# - deploy/keycloak/keycloak-init.sh +# - deploy/kernel/install.sh +# - deploy/mock-smtp/install.sh +# - deploy/signup-with-plugins/signup-with-mock-plugin/install.sh +# - deploy/signup-ui/install.sh +# ============================================================================= + +helmDefaults: + tillerNamespace: kube-system + tillerless: true + install: true + +helmRepos: + mosip: https://mosip.github.io/mosip-helm + +namespaces: + signup-2-0-0: + protected: false + kernel-2-0-0: + protected: false + mock-smtp-2-0-0: + protected: false + +apps: + # --------------------------------------------------------------------------- + # Signup Keycloak Init + # --------------------------------------------------------------------------- + # Creates mosip-signup-client with required roles in Keycloak. + # Propagates mosip_signup_client_secret between keycloak and signup namespaces. + signup-keycloak-init-2-0-0: + namespace: signup-2-0-0 + enabled: false + version: 12.0.2 + chart: mosip/keycloak-init + valuesFile: "$WORKDIR/utils/keycloak-signup-init-values.yaml" + set: + keycloakInternalHost: "keycloak.keycloak" + keycloakExternalHost: "iam.${domain_name}" + wait: true + waitForJobs: true + timeout: 300 + priority: -10 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh" + + # --------------------------------------------------------------------------- + # Kernel Services + # --------------------------------------------------------------------------- + # Required for audit logging (auditmanager), OTP generation (otpmanager), + # auth token validation (authmanager), and email/SMS dispatch (notifier). + # kernel-preinstall.sh creates kernel namespace and domain-config configmap. + authmanager-2-0-0: + namespace: kernel-2-0-0 + enabled: false + version: 12.0.1 + chart: mosip/authmanager + set: + enable_insecure: "false" + wait: true + timeout: 600 + priority: -8 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + + auditmanager-2-0-0: + namespace: kernel-2-0-0 + enabled: false + version: 12.0.1 + chart: mosip/auditmanager + set: + enable_insecure: "false" + wait: true + timeout: 600 + priority: -8 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + + otpmanager-2-0-0: + namespace: kernel-2-0-0 + enabled: false + version: 12.0.1 + chart: mosip/otpmanager + wait: true + timeout: 600 + priority: -8 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + + notifier-2-0-0: + namespace: kernel-2-0-0 + enabled: false + version: 12.0.1 + chart: mosip/notifier + wait: true + timeout: 600 + priority: -7 + hooks: + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh" + + # --------------------------------------------------------------------------- + # Mock SMTP (Optional — dev/test email and SMS) + # --------------------------------------------------------------------------- + mock-smtp-2-0-0: + namespace: mock-smtp-2-0-0 + enabled: false + version: 1.0.0 + chart: mosip/mock-smtp + set: + istio.hosts[0]: "smtp-2-0-0.${domain_name}" + wait: true + timeout: 300 + priority: -5 + + # --------------------------------------------------------------------------- + # Signup Service (with esignet-mock-plugin) + # --------------------------------------------------------------------------- + # signup-service-preinstall.sh copies redis secrets, creates keycloak-host + # configmap, signup-captcha and signup-keystore secrets, and msg-gateway + # configmap/secret pointing to mock-smtp. + signup-2-0-0: + namespace: signup-2-0-0 + enabled: false + version: 1.2.2 + chart: mosip/signup + set: + image.repository: "mosipid/signup-service" + image.tag: "1.2.2" + enable_insecure: "false" + plugin_name_env: "esignet-mock-plugin.jar" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-2-0-0.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-2-0-0.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" + wait: true + timeout: 600 + priority: -4 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh" + + # --------------------------------------------------------------------------- + # Signup UI + # --------------------------------------------------------------------------- + signup-ui-2-0-0: + namespace: signup-2-0-0 + enabled: false + version: 1.2.2 + chart: mosip/signup-ui + set: + image.repository: "mosipid/signup-ui" + image.tag: "1.2.2" + istio.hosts[0]: "signup-2-0-0.${domain_name}" + signup_ui.signup_service_host: "signup-2-0-0.signup-2-0-0" + signup_ui.configmaps.signup-ui.REACT_APP_API_BASE_URL: "http://signup-2-0-0.signup-2-0-0/v1/signup" + signup_ui.configmaps.signup-ui.REACT_APP_SBI_DOMAIN_URI: "http://signup-2-0-0.signup-2-0-0" + wait: true + timeout: 600 + priority: -3 diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml new file mode 100644 index 000000000..78a6076cb --- /dev/null +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -0,0 +1,276 @@ +helmDefaults: + tillerNamespace: kube-system + tillerless: true + install: true + +helmRepos: + bitnami: https://charts.bitnami.com/bitnami + mosip: https://mosip.github.io/mosip-helm + +# Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): +# esignet-apitestrig → esignet ns +# esignet-mosipid1-apitestrig → esignet-mosipid1 ns +# esignet-mosipid2-apitestrig → esignet-mosipid2 ns +# esignet-sunbird-apitestrig → esignet-sunbird ns +# esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) +# signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) +namespaces: + esignet-mosipid1-2-0-0: + protected: false + esignet-mock-2-0-0: + protected: false + esignet-mosipid2-2-0-0: + protected: false + esignet-sunbird-2-0-0: + protected: false + signup-2-0-0: + protected: false + signup-uitestrig-2-0-0: + protected: false + +apps: + # --------------------------------------------------------------------------- + # eSignet API Testrig — main esignet namespace + # --------------------------------------------------------------------------- + esignet-apitestrig-2-0-0: + namespace: esignet-mock-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/apitestrig + valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" + set: + extraEnvVarsCM[0]: "esignet-global" + extraEnvVarsCM[1]: "s3" + extraEnvVarsCM[2]: "keycloak-host" + extraEnvVarsCM[3]: "db" + extraEnvVarsCM[4]: "apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-apitestrig" + extraEnvVarsSecret[2]: "keycloak-client-secrets" + extraEnvVarsSecret[3]: "postgres-postgresql" + crontime: "0 2 * * *" + apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' + apitestrig.configmaps.s3.s3-user-key: 'admin' + apitestrig.configmaps.s3.s3-region: '' + apitestrig.configmaps.db.db-server: "api-internal.${domain_name}" + apitestrig.configmaps.db.db-su-user: "postgres" + apitestrig.configmaps.db.db-port: "${esignet_db_port}" + apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" + apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" + apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" + apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" + apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" + apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" + apitestrig.configmaps.apitestrig.NS: "esignet-mock-2-0-0" + apitestrig.configmaps.apitestrig.servicesNotDeployed: '' + apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" + apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" + apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-2-0-0.${domain_name}" + apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" + secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" + apitestrig.variables.push_reports_to_s3: "yes" + priority: -5 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet API Testrig — esignet-mosipid1 namespace (mosip-identity-plugin) + # --------------------------------------------------------------------------- + esignet-mosipid1-apitestrig-2-0-0: + namespace: esignet-mosipid1-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/apitestrig + valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" + set: + extraEnvVarsCM[0]: "esignet-global" + extraEnvVarsCM[1]: "s3" + extraEnvVarsCM[2]: "keycloak-host" + extraEnvVarsCM[3]: "db" + extraEnvVarsCM[4]: "apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid1-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-mosipid1-apitestrig" + extraEnvVarsSecret[2]: "keycloak-client-secrets" + extraEnvVarsSecret[3]: "postgres-postgresql" + crontime: "0 2 * * *" + apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' + apitestrig.configmaps.s3.s3-user-key: 'admin' + apitestrig.configmaps.s3.s3-region: '' + apitestrig.configmaps.db.db-server: "api-internal.${mosipid1_domain_name}" + apitestrig.configmaps.db.db-su-user: "postgres" + apitestrig.configmaps.db.db-port: "${esignet_db_port}" + apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" + apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" + apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" + apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" + apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" + apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" + apitestrig.configmaps.apitestrig.NS: "esignet-mosipid1-2-0-0" + apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' + apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" + apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" + apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid1-2-0-0.${domain_name}" + apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid1_domain_name};idrepository=api-internal.${mosipid1_domain_name};authmanager=api-internal.${mosipid1_domain_name};resident=api-internal.${mosipid1_domain_name};partnermanager=pms-mosipid1-2-0-0.${mosipid1_domain_name};idauthentication=api-internal.${mosipid1_domain_name};masterdata=api-internal.${mosipid1_domain_name};idgenerator=api-internal.${mosipid1_domain_name};policymanager=pms-mosipid1-2-0-0.${mosipid1_domain_name};preregistration=api-internal.${mosipid1_domain_name};keymanager=api-internal.${mosipid1_domain_name};" + secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" + apitestrig.variables.push_reports_to_s3: "yes" + priority: -4 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet API Testrig — esignet-mosipid2 namespace (mosip-identity-plugin) + # --------------------------------------------------------------------------- + esignet-mosipid2-apitestrig-2-0-0: + namespace: esignet-mosipid2-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/apitestrig + valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" + set: + extraEnvVarsCM[0]: "esignet-global" + extraEnvVarsCM[1]: "s3" + extraEnvVarsCM[2]: "keycloak-host" + extraEnvVarsCM[3]: "db" + extraEnvVarsCM[4]: "apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid2-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-mosipid2-apitestrig" + extraEnvVarsSecret[2]: "keycloak-client-secrets" + extraEnvVarsSecret[3]: "postgres-postgresql" + crontime: "0 2 * * *" + apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' + apitestrig.configmaps.s3.s3-user-key: 'admin' + apitestrig.configmaps.s3.s3-region: '' + apitestrig.configmaps.db.db-server: "api-internal.${mosipid2_domain_name}" + apitestrig.configmaps.db.db-su-user: "postgres" + apitestrig.configmaps.db.db-port: "${esignet_db_port}" + apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" + apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" + apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" + apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" + apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" + apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" + apitestrig.configmaps.apitestrig.NS: "esignet-mosipid2-2-0-0" + apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' + apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" + apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" + apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid2-2-0-0.${domain_name}" + apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid2_domain_name};idrepository=api-internal.${mosipid2_domain_name};authmanager=api-internal.${mosipid2_domain_name};resident=api-internal.${mosipid2_domain_name};partnermanager=pms-mosipid2-2-0-0.${mosipid2_domain_name};idauthentication=api-internal.${mosipid2_domain_name};masterdata=api-internal.${mosipid2_domain_name};idgenerator=api-internal.${mosipid2_domain_name};policymanager=pms-mosipid2-2-0-0.${mosipid2_domain_name};preregistration=api-internal.${mosipid2_domain_name};keymanager=api-internal.${mosipid2_domain_name};" + secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" + apitestrig.variables.push_reports_to_s3: "yes" + priority: -3 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet API Testrig — esignet-sunbird namespace (sunbird-rc-plugin) + # postInstall triggers all four testrig namespaces after last one deploys. + # --------------------------------------------------------------------------- + esignet-sunbird-apitestrig-2-0-0: + namespace: esignet-sunbird-2-0-0 + enabled: true + version: 0.0.1-develop + chart: mosip/apitestrig + valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" + set: + extraEnvVarsCM[0]: "esignet-global" + extraEnvVarsCM[1]: "s3" + extraEnvVarsCM[2]: "keycloak-host" + extraEnvVarsCM[3]: "db" + extraEnvVarsCM[4]: "apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-sunbird-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-sunbird-apitestrig" + extraEnvVarsSecret[2]: "keycloak-client-secrets" + extraEnvVarsSecret[3]: "postgres-postgresql" + crontime: "0 2 * * *" + apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' + apitestrig.configmaps.s3.s3-user-key: 'admin' + apitestrig.configmaps.s3.s3-region: '' + apitestrig.configmaps.db.db-server: "api-internal.${domain_name}" + apitestrig.configmaps.db.db-su-user: "postgres" + apitestrig.configmaps.db.db-port: "${esignet_db_port}" + apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" + apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" + apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" + apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" + apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" + apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" + apitestrig.configmaps.apitestrig.NS: "esignet-sunbird-2-0-0" + apitestrig.configmaps.apitestrig.servicesNotDeployed: '' + apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" + apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" + apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-sunbird-2-0-0.${domain_name}" + apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" + apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid1_domain_name}" + secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" + apitestrig.variables.push_reports_to_s3: "yes" + priority: -2 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh" + # postInstall: "$WORKDIR/hooks/esignet-standalone/trigger-test-jobs-esignet.sh" + + # --------------------------------------------------------------------------- + # Signup API Test Rig — disabled by default + # Enable only if signup stack (signup-dsf) is deployed. + # --------------------------------------------------------------------------- + esignet-signup-apitestrig-2-0-0: + namespace: signup-2-0-0 + enabled: false + version: 0.0.1-develop + chart: mosip/apitestrig + valuesFile: "$WORKDIR/utils/esignet-signup-apitestrig-values.yaml" + set: + crontime: "0 2 * * *" + apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' + apitestrig.configmaps.s3.s3-user-key: 'admin' + apitestrig.configmaps.s3.s3-region: '' + apitestrig.configmaps.db.db-server: "api-internal.${domain_name}" + apitestrig.configmaps.db.db-su-user: "postgres" + apitestrig.configmaps.db.db-port: "${esignet_db_port}" + apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" + apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" + apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" + apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" + apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" + apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" + apitestrig.configmaps.apitestrig.NS: "signup-2-0-0" + apitestrig.configmaps.apitestrig.servicesNotDeployed: '' + secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" + apitestrig.variables.push_reports_to_s3: "yes" + priority: -2 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh" + + # --------------------------------------------------------------------------- + # Signup UI Test Rig — disabled by default + # Enable only if signup stack (signup-dsf) is deployed. + # --------------------------------------------------------------------------- + signup-uitestrig-2-0-0: + namespace: signup-uitestrig-2-0-0 + enabled: false + version: 0.0.1-develop + chart: mosip/uitestrig + valuesFile: "$WORKDIR/utils/signup-uitestrig-values.yaml" + set: + crontime: "0 3 * * *" + uitestrig.configmaps.s3.s3-host: "http://minio.minio:9000" + uitestrig.configmaps.s3.s3-user-key: "admin" + uitestrig.configmaps.s3.s3-region: "" + uitestrig.configmaps.db.db-server: "api-internal.${domain_name}" + uitestrig.configmaps.db.db-su-user: "postgres" + uitestrig.configmaps.db.db-port: "${esignet_db_port}" + uitestrig.configmaps.uitestrig.ENV_USER: "api-internal.${env_name}" + uitestrig.configmaps.uitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" + uitestrig.configmaps.uitestrig.reportExpirationInDays: "3" + uitestrig.configmaps.uitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" + uitestrig.configmaps.uitestrig.eSignetDeployed: "yes" + uitestrig.configmaps.uitestrig.NS: "signup-uitestrig-2-0-0" + uitestrig.variables.push_reports_to_s3: "yes" + priority: -1 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh" diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index d927abbaf..5e0bdf77d 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -174,6 +174,70 @@ apps: databases.mosip_mockidentitysystem.repoUrl: "https://github.com/mosip/esignet-mock-services.git" databases.mosip_mockidentitysystem.port: ${esignet_db_port} databases.mosip_mockidentitysystem.dml: 1 + # --------------------------------------------------------------------------- + # esignet-standalone-2.0.0 profile — isolated databases (own data, shared postgres) + # --------------------------------------------------------------------------- + databases.mosip_esignet_2_0_0.enabled: "true" + databases.mosip_esignet_2_0_0.scriptsDir: "mosip_esignet" + databases.mosip_esignet_2_0_0.dbName: "mosip_esignet_2_0_0" + databases.mosip_esignet_2_0_0.dbUser: "esignetuser_2_0_0" + databases.mosip_esignet_2_0_0.branch: "develop" + databases.mosip_esignet_2_0_0.host: "postgres.${domain_name}" + databases.mosip_esignet_2_0_0.port: ${esignet_db_port} + databases.mosip_esignet_2_0_0.dml: 1 + databases.mosip_esignet_2_0_0.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_2_0_0.defaultDb: "postgres" + databases.mosip_esignet_2_0_0.su.user: "postgres" + databases.mosip_esignet_2_0_0.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_2_0_0.su.secret.key: "postgres-password" + databases.mosip_esignet_mosipid1_2_0_0.enabled: "true" + databases.mosip_esignet_mosipid1_2_0_0.scriptsDir: "mosip_esignet" + databases.mosip_esignet_mosipid1_2_0_0.dbName: "mosip_esignet_mosipid1_2_0_0" + databases.mosip_esignet_mosipid1_2_0_0.dbUser: "esignetuser_mosipid1_2_0_0" + databases.mosip_esignet_mosipid1_2_0_0.branch: "develop" + databases.mosip_esignet_mosipid1_2_0_0.host: "postgres.${domain_name}" + databases.mosip_esignet_mosipid1_2_0_0.port: ${esignet_db_port} + databases.mosip_esignet_mosipid1_2_0_0.dml: 1 + databases.mosip_esignet_mosipid1_2_0_0.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_mosipid1_2_0_0.defaultDb: "postgres" + databases.mosip_esignet_mosipid1_2_0_0.su.user: "postgres" + databases.mosip_esignet_mosipid1_2_0_0.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_mosipid1_2_0_0.su.secret.key: "postgres-password" + databases.mosip_esignet_mosipid2_2_0_0.enabled: "true" + databases.mosip_esignet_mosipid2_2_0_0.scriptsDir: "mosip_esignet" + databases.mosip_esignet_mosipid2_2_0_0.dbName: "mosip_esignet_mosipid2_2_0_0" + databases.mosip_esignet_mosipid2_2_0_0.dbUser: "esignetuser_mosipid2_2_0_0" + databases.mosip_esignet_mosipid2_2_0_0.branch: "develop" + databases.mosip_esignet_mosipid2_2_0_0.host: "postgres.${domain_name}" + databases.mosip_esignet_mosipid2_2_0_0.port: ${esignet_db_port} + databases.mosip_esignet_mosipid2_2_0_0.dml: 1 + databases.mosip_esignet_mosipid2_2_0_0.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_mosipid2_2_0_0.defaultDb: "postgres" + databases.mosip_esignet_mosipid2_2_0_0.su.user: "postgres" + databases.mosip_esignet_mosipid2_2_0_0.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_mosipid2_2_0_0.su.secret.key: "postgres-password" + databases.mosip_esignet_sunbird_2_0_0.enabled: "true" + databases.mosip_esignet_sunbird_2_0_0.scriptsDir: "mosip_esignet" + databases.mosip_esignet_sunbird_2_0_0.dbName: "mosip_esignet_sunbird_2_0_0" + databases.mosip_esignet_sunbird_2_0_0.dbUser: "esignetuser_sunbird_2_0_0" + databases.mosip_esignet_sunbird_2_0_0.branch: "develop" + databases.mosip_esignet_sunbird_2_0_0.host: "postgres.${domain_name}" + databases.mosip_esignet_sunbird_2_0_0.port: ${esignet_db_port} + databases.mosip_esignet_sunbird_2_0_0.dml: 1 + databases.mosip_esignet_sunbird_2_0_0.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_sunbird_2_0_0.defaultDb: "postgres" + databases.mosip_esignet_sunbird_2_0_0.su.user: "postgres" + databases.mosip_esignet_sunbird_2_0_0.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_sunbird_2_0_0.su.secret.key: "postgres-password" + databases.mosip_mockidentitysystem_2_0_0.enabled: "true" + databases.mosip_mockidentitysystem_2_0_0.scriptsDir: "mosip_mockidentitysystem" + databases.mosip_mockidentitysystem_2_0_0.dbName: "mosip_mockidentitysystem_2_0_0" + databases.mosip_mockidentitysystem_2_0_0.dbUser: "mockidentityuser_2_0_0" + databases.mosip_mockidentitysystem_2_0_0.branch: "develop" + databases.mosip_mockidentitysystem_2_0_0.host: "postgres.${domain_name}" + databases.mosip_mockidentitysystem_2_0_0.repoUrl: "https://github.com/mosip/esignet-mock-services.git" + databases.mosip_mockidentitysystem_2_0_0.port: ${esignet_db_port} + databases.mosip_mockidentitysystem_2_0_0.dml: 1 wait: true timeout: 300 priority: -16 @@ -230,6 +294,27 @@ apps: databases.mosip_otp.host: "postgres.${domain_name}" databases.mosip_otp.port: ${esignet_db_port} databases.mosip_otp.dml: 0 + # --------------------------------------------------------------------------- + # esignet-standalone-2.0.0 profile — isolated signup/kernel databases + # --------------------------------------------------------------------------- + databases.mosip_audit_2_0_0.enabled: "true" + databases.mosip_audit_2_0_0.branch: "v1.2.0.1" + databases.mosip_audit_2_0_0.repoUrl: "https://github.com/mosip/audit-manager.git" + databases.mosip_audit_2_0_0.host: "postgres.${domain_name}" + databases.mosip_audit_2_0_0.port: ${esignet_db_port} + databases.mosip_audit_2_0_0.dml: 0 + databases.mosip_kernel_2_0_0.enabled: "true" + databases.mosip_kernel_2_0_0.branch: "v1.2.0.1" + databases.mosip_kernel_2_0_0.repoUrl: "https://github.com/mosip/commons.git" + databases.mosip_kernel_2_0_0.host: "postgres.${domain_name}" + databases.mosip_kernel_2_0_0.port: ${esignet_db_port} + databases.mosip_kernel_2_0_0.dml: 0 + databases.mosip_otp_2_0_0.enabled: "true" + databases.mosip_otp_2_0_0.branch: "v1.2.0.1" + databases.mosip_otp_2_0_0.repoUrl: "https://github.com/mosip/otp-manager.git" + databases.mosip_otp_2_0_0.host: "postgres.${domain_name}" + databases.mosip_otp_2_0_0.port: ${esignet_db_port} + databases.mosip_otp_2_0_0.dml: 0 wait: true timeout: 300 priority: -16 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh new file mode 100755 index 000000000..345ea71b0 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup +# ============================================================================= +# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 +# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql +# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# ============================================================================= +set -euo pipefail + +NS=esignet-mosipid1-2-0-0 +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install" +echo "================================================" + +echo "Deleting stale testrig configmaps in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 +kubectl -n "$NS" delete --ignore-not-found=true configmap db +kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig + +echo "Copying postgres-postgresql secret to $NS" +$COPY_UTIL secret postgres-postgresql postgres "$NS" + +echo "eSignet-MOSIPID1 API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh new file mode 100755 index 000000000..ffa4f388d --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup +# ============================================================================= +# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 +# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql +# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# ============================================================================= +set -euo pipefail + +NS=esignet-mosipid2-2-0-0 +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install" +echo "================================================" + +echo "Deleting stale testrig configmaps in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 +kubectl -n "$NS" delete --ignore-not-found=true configmap db +kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig + +echo "Copying postgres-postgresql secret to $NS" +$COPY_UTIL secret postgres-postgresql postgres "$NS" + +echo "eSignet-MOSIPID2 API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh new file mode 100755 index 000000000..7c4e87add --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet API Testrig Pre-install Setup +# ============================================================================= +# Prepares the esignet-mock namespace for the esignet-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-mock ns +# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql +# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# ============================================================================= +set -euo pipefail + +NS=esignet-mock-2-0-0 +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - eSignet API Testrig Pre-install" +echo "================================================" + +echo "Deleting stale testrig configmaps in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 +kubectl -n "$NS" delete --ignore-not-found=true configmap db +kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig + +echo "Copying postgres-postgresql secret to $NS" +$COPY_UTIL secret postgres-postgresql postgres "$NS" + +echo "eSignet API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh new file mode 100755 index 000000000..e5ade4121 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install Setup +# ============================================================================= +# Prepares the esignet-sunbird namespace for the esignet-sunbird-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-sunbird +# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql +# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# ============================================================================= +set -euo pipefail + +NS=esignet-sunbird-2-0-0 +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install" +echo "================================================" + +echo "Deleting stale testrig configmaps in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 +kubectl -n "$NS" delete --ignore-not-found=true configmap db +kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig + +echo "Copying postgres-postgresql secret to $NS" +$COPY_UTIL secret postgres-postgresql postgres "$NS" + +echo "eSignet-Sunbird API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh new file mode 100755 index 000000000..7453c149f --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Signup API Testrig Pre-install Setup +# ============================================================================= +# Prepares the signup namespace for the esignet-signup-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in signup ns +# (copied by signup-keycloak-init-postinstall.sh). Only postgres-postgresql +# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# ============================================================================= +set -euo pipefail + +NS=signup-2-0-0 +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Signup API Testrig Pre-install" +echo "================================================" + +echo "Deleting stale testrig configmaps in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 +kubectl -n "$NS" delete --ignore-not-found=true configmap db +kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig + +echo "Copying postgres-postgresql secret to $NS" +$COPY_UTIL secret postgres-postgresql postgres "$NS" + +echo "Signup API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh new file mode 100755 index 000000000..1d439c4b0 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh @@ -0,0 +1,56 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Captcha Post-install +# ============================================================================= +# Based on: deploy/captcha/install.sh +# Configures captcha secrets for eSignet and patches captcha deployment +# with the secret key environment variable. +# +# Environment Variables: +# CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) +# CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +CAPTCHA_NS="captcha" +CAPTCHA_SITE_KEY="${ESIGNET_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_CAPTCHA_SITE_KEY environment variable must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_CAPTCHA_SECRET_KEY environment variable must be set}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Captcha Post-install" +echo "================================================" + +# --- Step 1: Create captcha secrets for eSignet --- +echo "Creating esignet-captcha secret in $ESIGNET_NS namespace" +kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha \ + --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- Step 2: Copy captcha secret to captcha namespace --- +echo "Copying esignet-captcha secret to $CAPTCHA_NS namespace" +$COPY_UTIL secret esignet-captcha "$ESIGNET_NS" "$CAPTCHA_NS" + +# --- Step 3: Patch captcha deployment with secret env var --- +echo "Patching captcha deployment with secret key environment variable" +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET')].name}" 2>/dev/null || echo "") + +if [[ -z "$ENV_VAR_EXISTS" ]]; then + echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var..." + ENV_ARRAY_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{.spec.template.spec.containers[0].env}" 2>/dev/null || echo "") + if [[ -z "$ENV_ARRAY_EXISTS" ]]; then + echo "env array not found, initializing..." + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env", "value": []}]' + fi + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha", "key": "esignet-captcha-secret-key"}}}}]' +else + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var already exists." +fi + +echo "Captcha post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh new file mode 100755 index 000000000..44e1dd728 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh @@ -0,0 +1,39 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Config-Server eSignet Post-install +# ============================================================================= +# Copies esignet-config-server-share CM from esignet-mock ns to mosipid1/mosipid2/sunbird, +# then patches active_profile_env and spring_config_label_env per namespace +# so each instance points to the correct config server profile and Git label. +# +# Environment variables (set in GitHub Actions workflow): +# ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL - Git label for esignet-mosipid1 (default: develop) +# ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL - Git label for esignet-mosipid2 (default: develop) +# ============================================================================= +set -euo pipefail + +SOURCE_NS="esignet-mock-2-0-0" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +CM_NAME="esignet-config-server-share" + +MOSIPID1_SPRING_LABEL="${ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL:-develop}" +MOSIPID2_SPRING_LABEL="${ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL:-develop}" + +echo "================================================" +echo "eSignet 1.7.1 - Config-Server eSignet Post-install" +echo "================================================" + +for TARGET_NS in esignet-mosipid1-2-0-0 esignet-mosipid2-2-0-0 esignet-sunbird-2-0-0; do + echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" + $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" +done + +echo "Patching $CM_NAME in esignet-mosipid1-2-0-0 (active_profile_env=mosipid1, spring_config_label_env=$MOSIPID1_SPRING_LABEL)" +kubectl -n esignet-mosipid1-2-0-0 patch configmap "$CM_NAME" --type merge \ + -p "{\"data\":{\"active_profile_env\":\"mosipid1\",\"spring_config_label_env\":\"$MOSIPID1_SPRING_LABEL\"}}" + +echo "Patching $CM_NAME in esignet-mosipid2-2-0-0 (active_profile_env=mosipid2, spring_config_label_env=$MOSIPID2_SPRING_LABEL)" +kubectl -n esignet-mosipid2-2-0-0 patch configmap "$CM_NAME" --type merge \ + -p "{\"data\":{\"active_profile_env\":\"mosipid2\",\"spring_config_label_env\":\"$MOSIPID2_SPRING_LABEL\"}}" + +echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh new file mode 100755 index 000000000..4f7e92cd9 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh @@ -0,0 +1,78 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Config-Server eSignet Pre-install +# ============================================================================= +# Based on: esignet/deploy/config-server/install.sh +# +# Prepares esignet namespace for config-server deployment: +# 1. Ensures namespace exists with Istio injection enabled +# 2. Copies db-common-secrets from postgres ns +# 3. Creates esignet-global ConfigMap from workflow env vars +# (domain_name set by helmsman_esignet.yml; available as shell env var +# in all hooks run within the same workflow step) +# 4. Pre-creates empty esignet-misp-onboarder-key secret as placeholder +# (MISP onboarder at priority -6 writes the real key; config-server is +# restarted by esignet-misp-onboarder-postinstall.sh afterwards) +# +# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart +# installs directly into the esignet namespace, so no cross-namespace copy needed. +# +# NOTE: keycloak resources (keycloak-host, keycloak-env-vars, keycloak, +# keycloak-client-secrets) are NOT copied here. They are populated in all +# esignet namespaces by esignet-postinstall-keycloak-init.sh which runs as +# part of external-dsf (esignet-keycloak-init at priority -11 in keycloak ns). +# By the time esignet-dsf runs, these resources are already present. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet) +# domain_name - base domain (set by workflow, e.g. sandbox.example.net) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +POSTGRES_NS="postgres" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Config-Server eSignet Pre-install" +echo "================================================" + +# --- Step 1: Ensure namespace with Istio --- +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# --- Step 2: Copy db-common-secrets --- +# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart +# creates it directly in the esignet namespace as a helm-managed resource. +echo "Copying db-common-secrets from $POSTGRES_NS" +$COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" + +# --- Step 3: Create esignet-global from workflow env vars --- +# domain_name is exported by the helmsman_esignet.yml workflow step +echo "Creating esignet-global configmap (domain_name=${domain_name:-UNSET})" +kubectl -n "$ESIGNET_NS" create configmap esignet-global \ + --from-literal=installation-domain="${domain_name}" \ + --from-literal=mosip-api-host="api.${domain_name}" \ + --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-2-0-0.${domain_name}" \ + --from-literal=mosip-iam-external-host="iam.${domain_name}" \ + --from-literal=mosip-kafka-host="kafka.${domain_name}" \ + --from-literal=mosip-postgres-host="postgres.${domain_name}" \ + --from-literal=mosip-signup-host="signup-2-0-0.${domain_name}" \ + --from-literal=mosip-smtp-host="smtp-2-0-0.${domain_name}" \ + --from-literal=mosip-version="develop" \ + --dry-run=client -o yaml | kubectl apply -f - +echo "esignet-global created/updated." + +# --- Step 4: Pre-create empty MISP key secret as placeholder --- +# Allows config-server pod to start. Real value written by MISP onboarder (-6). +# esignet-misp-onboarder-postinstall.sh restarts config-server after writing. +if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then + kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ + --from-literal=mosip-esignet-misp-key="" + echo "esignet-misp-onboarder-key placeholder created." +else + echo "esignet-misp-onboarder-key already exists, skipping placeholder." +fi + +echo "Config-server eSignet pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh new file mode 100755 index 000000000..863bd0b9f --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Database Init Post-install (postgres-init-esignet-mock) +# ============================================================================= +# postgres-init-esignet-mock runs in the postgres namespace and creates +# db-common-secrets there. This hook copies it to all esignet-mock namespaces +# so each eSignet instance can use it for DB connections. +# ============================================================================= +set -euo pipefail + +POSTGRES_NS="postgres" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Database Init Post-install" +echo "================================================" + +for NS in esignet-mock-2-0-0 esignet-mosipid1-2-0-0 esignet-mosipid2-2-0-0 esignet-sunbird-2-0-0; do + echo "Copying db-common-secrets from $POSTGRES_NS to $NS" + $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$NS" +done + +echo "Database init post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh new file mode 100755 index 000000000..02d2c433d --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh @@ -0,0 +1,24 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Database Init Pre-install (postgres-init-esignet-mock) +# ============================================================================= +# Based on: deploy/postgres/postgres-init.sh +# postgres-init-esignet-mock runs in the postgres namespace so it can access +# postgres-postgresql secret natively. This hook pre-creates all esignet-mock +# namespaces so the postInstall hook can copy db-common-secrets into each. +# Namespaces are created here at priority -16 because the namespace-specific +# preinstall hooks (esignet-mosipid1/mosipid2/sunbird) only run at priority -14. +# ============================================================================= +set -euo pipefail + +echo "================================================" +echo "eSignet 1.7.1 - Database Init Pre-install" +echo "================================================" + +for NS in esignet-mock-2-0-0 esignet-mosipid1-2-0-0 esignet-mosipid2-2-0-0 esignet-sunbird-2-0-0; do + kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - + kubectl label namespace "$NS" istio-injection=enabled --overwrite + echo "Namespace $NS ready." +done + +echo "Database init pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh new file mode 100755 index 000000000..02e4c7929 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet MISP Partner Onboarder Post-install +# ============================================================================= +# Validates onboarding job completion and restarts the esignet deployment +# so it picks up the new MISP license key. +# Only used with mosip-identity-plugin (plugin 2). +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" + +echo "================================================" +echo "eSignet 1.7.1 - MISP Onboarder Post-install" +echo "================================================" + +JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ + -l app.kubernetes.io/instance=esignet-misp-onboarder-2-0-0 \ + -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") + +if [ "$JOB_STATUS" = "1" ]; then + echo "eSignet MISP partner onboarding completed successfully." +else + echo "WARNING: onboarding job may not have completed. Check logs:" + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder-2-0-0 --tail=30 2>/dev/null || true +fi + +# Re-enable Istio sidecar injection now that the Job has completed +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite +echo "Istio injection re-enabled on namespace $ESIGNET_NS." + +# Restart config-server first so it reloads the MISP key from the secret, +# then restart esignet so it fetches the updated config from config-server. +if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server-2-0-0 &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server-2-0-0 + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-2-0-0 --timeout=300s || \ + echo "WARNING: esignet-config-server-2-0-0 rollout did not complete within timeout." >&2 + echo "esignet-config-server-2-0-0 restarted." +else + echo "esignet-config-server-2-0-0 deployment not found — skipping restart." +fi + +if kubectl -n "$ESIGNET_NS" get deployment esignet-mock-2-0-0 &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-mock-2-0-0 + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-mock-2-0-0 --timeout=300s || \ + echo "WARNING: esignet rollout did not complete within timeout." >&2 + echo "esignet deployment restarted." +else + echo "esignet deployment not found — skipping restart." +fi + +echo "MISP onboarder post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh new file mode 100755 index 000000000..af5993f20 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -0,0 +1,46 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet MISP Partner Onboarder Pre-install +# ============================================================================= +# Prepares the esignet namespace for the MISP onboarder Job: +# - Disables Istio sidecar injection so the Job pod can reach Completed state +# - Deletes stale MISP onboarder artifacts from previous runs (idempotency) +# - Copies keycloak resources needed by the onboarder Job +# - Deletes onboarder-namespace ConfigMap so this release owns it cleanly +# - Waits for the esignet pod to be ready before the Job starts +# Only used with mosip-identity-plugin (plugin 2). +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +KEYCLOAK_NS="keycloak" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - MISP Onboarder Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +# Disable Istio sidecar injection — Job pods with sidecars never reach Completed state +kubectl label namespace "$ESIGNET_NS" istio-injection=disabled --overwrite +echo "Istio injection disabled on namespace $ESIGNET_NS." + +# Delete stale MISP onboarder artifacts from any previous run +kubectl -n "$ESIGNET_NS" delete configmap esignet-onboarder-config --ignore-not-found=true +kubectl -n "$ESIGNET_NS" delete secret esignet-onboarder-secrets --ignore-not-found=true +echo "Stale MISP onboarder artifacts cleaned up." + +# Copy keycloak resources needed by the onboarder Job +$COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$ESIGNET_NS" +$COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" +$COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" + +# Delete onboarder-namespace ConfigMap so this release owns it with the correct annotation +kubectl -n "$ESIGNET_NS" delete configmap onboarder-namespace --ignore-not-found=true + +# Verify eSignet service is running before the onboarder Job starts +kubectl -n "$ESIGNET_NS" wait --for=condition=ready pod -l app.kubernetes.io/name=esignet --timeout=480s || \ + { echo "ERROR: eSignet pods not ready after timeout" >&2; exit 1; } + +echo "MISP onboarder pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh new file mode 100755 index 000000000..6780d27bc --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock RP OIDC Partner Onboarder Post-install +# ============================================================================= +# Validates onboarding job completion and restarts mock-relying-party-service +# so it picks up the newly registered OIDC client. +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" + +echo "================================================" +echo "eSignet 1.7.1 - Mock RP Onboarder Post-install" +echo "================================================" + +JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ + -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-2-0-0 \ + -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") + +if [ "$JOB_STATUS" = "1" ]; then + echo "Mock RP OIDC partner onboarding completed successfully." +else + echo "WARNING: onboarding job may not have completed. Check logs:" + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-2-0-0 --tail=30 2>/dev/null || true +fi + +# Re-enable Istio sidecar injection now that the Job has completed +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite +echo "Istio injection re-enabled on namespace $ESIGNET_NS." + +# Restart mock-relying-party-service so it picks up the newly onboarded OIDC client +if kubectl -n "$ESIGNET_NS" get deployment mock-relying-party-service-2-0-0 &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment mock-relying-party-service-2-0-0 + kubectl -n "$ESIGNET_NS" rollout status deployment mock-relying-party-service-2-0-0 --timeout=300s || \ + echo "WARNING: mock-relying-party-service-2-0-0 rollout did not complete within timeout." >&2 + echo "mock-relying-party-service-2-0-0 restarted." +else + echo "mock-relying-party-service-2-0-0 deployment not found — skipping restart." +fi + +echo "Mock RP onboarder post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh new file mode 100755 index 000000000..262bd4a32 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh @@ -0,0 +1,37 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock RP OIDC Partner Onboarder Pre-install +# ============================================================================= +# Copies required secrets/configmaps to esignet namespace before the +# partner-onboarder Job runs. +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +KEYCLOAK_NS="keycloak" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Mock RP Onboarder Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +# Disable Istio sidecar injection — Job pods with sidecars never reach Completed state +kubectl label namespace "$ESIGNET_NS" istio-injection=disabled --overwrite +echo "Istio injection disabled on namespace $ESIGNET_NS." + +# Copy keycloak resources needed by the onboarder Job +$COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$ESIGNET_NS" +$COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" +$COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" + +# Both partner-onboarder charts create a ConfigMap named "onboarder-namespace". +# Delete it before install so this release owns it with the correct annotation. +kubectl -n "$ESIGNET_NS" delete configmap onboarder-namespace --ignore-not-found=true + +# Verify eSignet service is running +kubectl -n "$ESIGNET_NS" wait --for=condition=ready pod -l app.kubernetes.io/name=esignet --timeout=480s || \ + { echo "ERROR: eSignet pods not ready after timeout" >&2; exit 1; } + +echo "Mock RP onboarder pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh new file mode 100755 index 000000000..2d4a6e224 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh @@ -0,0 +1,127 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet MOSIPID1 Service Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid1, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-mosipid1-2-0-0 secret +# in the captcha namespace from workflow env vars, copies it to esignet-mosipid1, +# and patches the captcha deployment with the MOSIPID1 secret key. +# ============================================================================= +set -euo pipefail + +export ESIGNET_NS="esignet-mosipid1-2-0-0" +CAPTCHA_NS="captcha" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY must be set}" +MOSIPID1_POSTGRES_PASS="${MOSIPID1_POSTGRES_PASSWORD:?ERROR: MOSIPID1_POSTGRES_PASSWORD must be set}" +MOSIPID1_KC_ADMIN_PASS="${MOSIPID1_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID1_KEYCLOAK_ADMIN_PASSWORD must be set}" + +"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" + +# Create MOSIPID1-specific esignet-global — same domain_name, but esignet/signup hosts differ +kubectl -n "$ESIGNET_NS" create configmap esignet-global \ + --from-literal=installation-domain="${domain_name}" \ + --from-literal=mosip-api-host="api.${domain_name}" \ + --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-mosipid1-2-0-0.${domain_name}" \ + --from-literal=mosip-iam-external-host="iam.${domain_name}" \ + --from-literal=mosip-kafka-host="kafka.${domain_name}" \ + --from-literal=mosip-postgres-host="postgres.${domain_name}" \ + --from-literal=mosip-signup-host="signup-mosipid1-2-0-0.${domain_name}" \ + --from-literal=mosip-smtp-host="smtp-2-0-0.${domain_name}" \ + --from-literal=mosip-version="develop" \ + --dry-run=client -o yaml | kubectl apply -f - + +# Override postgres-config with MOSIPID1-specific DB values (2.0.0: isolated database) +kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ + -p '{"data":{"database-name":"mosip_esignet_mosipid1_2_0_0","database-username":"esignetuser_mosipid1_2_0_0"}}' + +# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. +if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then + kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ + --from-literal=mosip-esignet-misp-key="" + echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" +fi + +echo "Creating esignet-captcha-mosipid1-2-0-0 secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid1-2-0-0 \ + --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying esignet-captcha-mosipid1-2-0-0 secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-mosipid1-2-0-0 "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETMOSIPID1 secret key" +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1_2_0_0')].name}" 2>/dev/null || echo "") +if [[ -z "$ENV_VAR_EXISTS" ]]; then + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1_2_0_0", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid1-2-0-0", "key": "esignet-captcha-secret-key"}}}}]' +else + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1_2_0_0 already exists." +fi + +# --- postgres-postgresql-mosipid1 secret (MOSIPID1 remote postgres password) --- +echo "Creating postgres-postgresql-mosipid1 secret in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid1 \ + --from-literal=postgres-password="${MOSIPID1_POSTGRES_PASS}" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- keycloak-host-mosipid1 CM (external URL points to MOSIPID1 Keycloak) --- +echo "Creating keycloak-host-mosipid1 configmap in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid1 \ + --from-literal=keycloak-external-host="iam.${mosipid1_domain_name}" \ + --from-literal=keycloak-external-url="https://iam.${mosipid1_domain_name}" \ + --from-literal=keycloak-internal-host="keycloak.keycloak" \ + --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ + --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- keycloak-client-secrets-mosipid1: fetch all confidential clients from MOSIPID1 Keycloak --- +KC_HOST="iam.${mosipid1_domain_name}" +REALM="mosip" + +echo "Fetching admin token from $KC_HOST" +TOKEN_RESPONSE=$(curl -sf -X POST \ + "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ + -H "Content-Type: application/x-www-form-urlencoded" \ + -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID1_KC_ADMIN_PASS}") +ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') +if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then + echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 +fi +echo "✓ Admin token obtained" + +echo "Fetching all clients from realm $REALM on $KC_HOST" +CLIENTS=$(curl -sf \ + "https://${KC_HOST}/auth/admin/realms/${REALM}/clients?max=500" \ + -H "Authorization: Bearer $ADMIN_TOKEN") + +SECRET_ARGS=() +while IFS= read -r client_json; do + client_id=$(echo "$client_json" | jq -r '.clientId') + uuid=$(echo "$client_json" | jq -r '.id') + auth_type=$(echo "$client_json" | jq -r '.clientAuthenticatorType') + is_public=$(echo "$client_json" | jq -r '.publicClient') + [[ "$auth_type" != "client-secret" || "$is_public" == "true" ]] && continue + secret_val=$(curl -sf \ + "https://${KC_HOST}/auth/admin/realms/${REALM}/clients/${uuid}/client-secret" \ + -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.value // empty') + [[ -z "$secret_val" || "$secret_val" == "null" ]] && continue + key=$(echo "$client_id" | tr '-' '_')_secret + SECRET_ARGS+=("--from-literal=${key}=${secret_val}") + echo " ✓ $client_id" +done < <(echo "$CLIENTS" | jq -c '.[]') + +if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then + echo "❌ No client secrets fetched from MOSIPID1 Keycloak" >&2; exit 1 +fi +echo "Creating keycloak-client-secrets-mosipid1 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid1 \ + "${SECRET_ARGS[@]}" \ + --dry-run=client -o yaml | kubectl apply -f - +echo "✓ keycloak-client-secrets-mosipid1 created" + +echo "eSignet MOSIPID1 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh new file mode 100755 index 000000000..b30ac5643 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh @@ -0,0 +1,127 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet MOSIPID2 Service Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid2, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-mosipid2-2-0-0 secret +# in the captcha namespace from workflow env vars, copies it to esignet-mosipid2, +# and patches the captcha deployment with the MOSIPID2 secret key. +# ============================================================================= +set -euo pipefail + +export ESIGNET_NS="esignet-mosipid2-2-0-0" +CAPTCHA_NS="captcha" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY must be set}" +MOSIPID2_POSTGRES_PASS="${MOSIPID2_POSTGRES_PASSWORD:?ERROR: MOSIPID2_POSTGRES_PASSWORD must be set}" +MOSIPID2_KC_ADMIN_PASS="${MOSIPID2_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID2_KEYCLOAK_ADMIN_PASSWORD must be set}" + +"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" + +# Create MOSIPID2-specific esignet-global — same domain_name, but esignet/signup hosts differ +kubectl -n "$ESIGNET_NS" create configmap esignet-global \ + --from-literal=installation-domain="${domain_name}" \ + --from-literal=mosip-api-host="api.${domain_name}" \ + --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-mosipid2-2-0-0.${domain_name}" \ + --from-literal=mosip-iam-external-host="iam.${domain_name}" \ + --from-literal=mosip-kafka-host="kafka.${domain_name}" \ + --from-literal=mosip-postgres-host="postgres.${domain_name}" \ + --from-literal=mosip-signup-host="signup-mosipid2-2-0-0.${domain_name}" \ + --from-literal=mosip-smtp-host="smtp-2-0-0.${domain_name}" \ + --from-literal=mosip-version="develop" \ + --dry-run=client -o yaml | kubectl apply -f - + +# Override postgres-config with MOSIPID2-specific DB values (2.0.0: isolated database) +kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ + -p '{"data":{"database-name":"mosip_esignet_mosipid2_2_0_0","database-username":"esignetuser_mosipid2_2_0_0"}}' + +# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. +if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then + kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ + --from-literal=mosip-esignet-misp-key="" + echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" +fi + +echo "Creating esignet-captcha-mosipid2-2-0-0 secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid2-2-0-0 \ + --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying esignet-captcha-mosipid2-2-0-0 secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-mosipid2-2-0-0 "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETMOSIPID2 secret key" +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2_2_0_0')].name}" 2>/dev/null || echo "") +if [[ -z "$ENV_VAR_EXISTS" ]]; then + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2_2_0_0", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid2-2-0-0", "key": "esignet-captcha-secret-key"}}}}]' +else + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2_2_0_0 already exists." +fi + +# --- postgres-postgresql-mosipid2 secret (MOSIPID2 remote postgres password) --- +echo "Creating postgres-postgresql-mosipid2 secret in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid2 \ + --from-literal=postgres-password="${MOSIPID2_POSTGRES_PASS}" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- keycloak-host-mosipid2 CM (external URL points to MOSIPID2 Keycloak) --- +echo "Creating keycloak-host-mosipid2 configmap in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid2 \ + --from-literal=keycloak-external-host="iam.${mosipid2_domain_name}" \ + --from-literal=keycloak-external-url="https://iam.${mosipid2_domain_name}" \ + --from-literal=keycloak-internal-host="keycloak.keycloak" \ + --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ + --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- keycloak-client-secrets-mosipid2: fetch all confidential clients from MOSIPID2 Keycloak --- +KC_HOST="iam.${mosipid2_domain_name}" +REALM="mosip" + +echo "Fetching admin token from $KC_HOST" +TOKEN_RESPONSE=$(curl -sf -X POST \ + "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ + -H "Content-Type: application/x-www-form-urlencoded" \ + -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID2_KC_ADMIN_PASS}") +ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') +if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then + echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 +fi +echo "✓ Admin token obtained" + +echo "Fetching all clients from realm $REALM on $KC_HOST" +CLIENTS=$(curl -sf \ + "https://${KC_HOST}/auth/admin/realms/${REALM}/clients?max=500" \ + -H "Authorization: Bearer $ADMIN_TOKEN") + +SECRET_ARGS=() +while IFS= read -r client_json; do + client_id=$(echo "$client_json" | jq -r '.clientId') + uuid=$(echo "$client_json" | jq -r '.id') + auth_type=$(echo "$client_json" | jq -r '.clientAuthenticatorType') + is_public=$(echo "$client_json" | jq -r '.publicClient') + [[ "$auth_type" != "client-secret" || "$is_public" == "true" ]] && continue + secret_val=$(curl -sf \ + "https://${KC_HOST}/auth/admin/realms/${REALM}/clients/${uuid}/client-secret" \ + -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.value // empty') + [[ -z "$secret_val" || "$secret_val" == "null" ]] && continue + key=$(echo "$client_id" | tr '-' '_')_secret + SECRET_ARGS+=("--from-literal=${key}=${secret_val}") + echo " ✓ $client_id" +done < <(echo "$CLIENTS" | jq -c '.[]') + +if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then + echo "❌ No client secrets fetched from MOSIPID2 Keycloak" >&2; exit 1 +fi +echo "Creating keycloak-client-secrets-mosipid2 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid2 \ + "${SECRET_ARGS[@]}" \ + --dry-run=client -o yaml | kubectl apply -f - +echo "✓ keycloak-client-secrets-mosipid2 created" + +echo "eSignet MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh new file mode 100755 index 000000000..856de8ab0 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# Post-install hook for esignet-keycloak-init (eSignet 1.7.1 standalone) +# The chart runs in keycloak ns and creates keycloak-host CM and +# keycloak-client-secrets secret there. This hook fans those resources out to +# all esignet-mock namespaces so every esignet-mock instance can reference them without +# cross-namespace lookups. +set -euo pipefail + +KEYCLOAK_NS="keycloak" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +# All esignet-mock namespaces that need keycloak resources +ESIGNET_NAMESPACES=(esignet-mock-2-0-0 esignet-mosipid1-2-0-0 esignet-mosipid2-2-0-0 esignet-sunbird-2-0-0) + +echo "================================================" +echo "eSignet 1.7.1 - Keycloak Init Post-install" +echo "================================================" + +echo "Sharing keycloak resources from $KEYCLOAK_NS to all esignet-mock-2-0-0 namespaces" +for NS_TARGET in "${ESIGNET_NAMESPACES[@]}"; do + if ! kubectl get namespace "$NS_TARGET" &>/dev/null; then + echo "Namespace $NS_TARGET does not exist, skipping" + continue + fi + echo " → $NS_TARGET" + $COPY_UTIL configmap keycloak-host "$KEYCLOAK_NS" "$NS_TARGET" + $COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$NS_TARGET" + $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$NS_TARGET" + $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$NS_TARGET" +done + +echo "Post-install setup complete." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall-keycloak-init.sh new file mode 100755 index 000000000..e8d7020e9 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall-keycloak-init.sh @@ -0,0 +1,51 @@ +#!/bin/bash +# Pre-install hook for esignet-keycloak-init (eSignet 1.7.1 standalone) +# Runs in the keycloak namespace — all required resources (keycloak secret, +# keycloak-env-vars CM) are already present from the bitnami keycloak chart. +# The chart creates keycloak-host CM and keycloak-client-secrets in keycloak ns. +# We clean up the previous release and chart-managed resources so the fresh +# helm install can recreate them cleanly. +set -euo pipefail + +KEYCLOAK_NS="keycloak" + +echo "================================================" +echo "eSignet 1.7.1 - Keycloak Init Pre-install" +echo "================================================" + +# Delete previous releases so helm install starts fresh. +# keycloak-host CM and keycloak-client-secrets secret are helm-managed — helm delete +# removes them automatically; no manual kubectl delete needed here. +helm -n "$KEYCLOAK_NS" delete esignet-keycloak-init 2>/dev/null || true +# Migration: remove old release from esignet ns if it was deployed there previously +helm -n esignet delete esignet-keycloak-init 2>/dev/null || true + +# Fetch existing client secrets from keycloak namespace for DSF ${VAR} substitution. +# Empty on fresh install — helm chart generates them; existing values preserved on re-run. +PMS_CLIENT_SECRET_KEY="mosip_pms_client_secret" +MPARTNER_DEFAULT_AUTH_SECRET_KEY="mpartner_default_auth_secret" +IDA_CLIENT_SECRET_KEY="mosip_ida_client_secret" +DEPLOYMENT_CLIENT_SECRET_KEY="mosip_deployment_client_secret" +MPARTNER_DEFAULT_MOBILE_SECRET_KEY="mpartner_default_mobile_secret" + +PMS_CLIENT_SECRET_VALUE="$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.${PMS_CLIENT_SECRET_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")" +export PMS_CLIENT_SECRET_KEY PMS_CLIENT_SECRET_VALUE + +MPARTNER_DEFAULT_AUTH_SECRET_VALUE="$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.${MPARTNER_DEFAULT_AUTH_SECRET_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")" +export MPARTNER_DEFAULT_AUTH_SECRET_KEY MPARTNER_DEFAULT_AUTH_SECRET_VALUE + +IDA_CLIENT_SECRET_VALUE="$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.${IDA_CLIENT_SECRET_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")" +export IDA_CLIENT_SECRET_KEY IDA_CLIENT_SECRET_VALUE + +DEPLOYMENT_CLIENT_SECRET_VALUE="$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.${DEPLOYMENT_CLIENT_SECRET_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")" +export DEPLOYMENT_CLIENT_SECRET_KEY DEPLOYMENT_CLIENT_SECRET_VALUE + +MPARTNER_DEFAULT_MOBILE_SECRET_VALUE="$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.${MPARTNER_DEFAULT_MOBILE_SECRET_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")" +export MPARTNER_DEFAULT_MOBILE_SECRET_KEY MPARTNER_DEFAULT_MOBILE_SECRET_VALUE + +echo "Pre-install setup complete. Helmsman will now deploy esignet-keycloak-init chart." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh new file mode 100755 index 000000000..34758454e --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -0,0 +1,62 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet Service Pre-install +# ============================================================================= +# Based on: deploy/esignet-mock/install.sh +# Prepares esignet-mock namespace with postgres and redis configmaps/secrets +# before eSignet helm chart deployment. +# +# softhsm-esignet-mock deploys in the esignet-mock namespace (priority -14, before +# esignet-mock at -12), so esignet-softhsm-share is already present — no copy needed. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet-mock) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +POSTGRES_NS="postgres" +REDIS_NS="redis" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - eSignet Service Pre-install" +echo "================================================" + +# --- Step 1: Ensure esignet-mock namespace exists with Istio --- +echo "Setting up $ESIGNET_NS namespace" +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# --- Step 2: Update helm repos --- +helm repo add mosip https://mosip.github.io/mosip-helm || true +helm repo update + +# --- Step 3: Copy configmaps from other namespaces --- +# All external services (postgres, redis) are guaranteed deployed before +# esignet-mock-dsf runs. +echo "Copying postgres-config configmap from $POSTGRES_NS" +$COPY_UTIL configmap postgres-config "$POSTGRES_NS" "$ESIGNET_NS" + +# Override postgres-config with 2.0.0-specific DB values (isolated database) +kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ + -p '{"data":{"database-name":"mosip_esignet_2_0_0","database-username":"esignetuser_2_0_0"}}' + +echo "Copying redis-config configmap from $REDIS_NS" +$COPY_UTIL configmap redis-config "$REDIS_NS" "$ESIGNET_NS" + +# --- Step 4: Copy secrets from other namespaces --- +echo "Copying postgres-postgresql secret from $POSTGRES_NS" +$COPY_UTIL secret postgres-postgresql "$POSTGRES_NS" "$ESIGNET_NS" + +echo "Copying redis secret from $REDIS_NS" +$COPY_UTIL secret redis "$REDIS_NS" "$ESIGNET_NS" + +# db-common-secrets is normally fanned out by esignet-db-postinstall.sh (part of the +# shared external-dsf.yaml postgres-init-esignet release), but that hook's namespace +# loop only covers the original esignet-standalone namespaces. Copy it directly here +# so the 2.0.0 namespace is self-sufficient without touching the shared hook. +echo "Copying db-common-secrets secret from $POSTGRES_NS" +$COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" + +echo "eSignet pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh new file mode 100755 index 000000000..6e0da08dc --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh @@ -0,0 +1,64 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet Sunbird Service Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-sunbird, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-sunbird-2-0-0 secret +# in the captcha namespace from workflow env vars, copies it to esignet-sunbird, +# and patches the captcha deployment with the Sunbird secret key. +# ============================================================================= +set -euo pipefail + +export ESIGNET_NS="esignet-sunbird-2-0-0" +CAPTCHA_NS="captcha" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +CAPTCHA_SITE_KEY="${ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY must be set}" + +"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" + +# Create Sunbird-specific esignet-global — same domain_name, but esignet/signup hosts differ +kubectl -n "$ESIGNET_NS" create configmap esignet-global \ + --from-literal=installation-domain="${domain_name}" \ + --from-literal=mosip-api-host="api.${domain_name}" \ + --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-sunbird-2-0-0.${domain_name}" \ + --from-literal=mosip-iam-external-host="iam.${domain_name}" \ + --from-literal=mosip-kafka-host="kafka.${domain_name}" \ + --from-literal=mosip-postgres-host="postgres.${domain_name}" \ + --from-literal=mosip-signup-host="signup-sunbird-2-0-0.${domain_name}" \ + --from-literal=mosip-smtp-host="smtp-2-0-0.${domain_name}" \ + --from-literal=mosip-version="develop" \ + --dry-run=client -o yaml | kubectl apply -f - + +# Override postgres-config with Sunbird-specific DB values +kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ + -p '{"data":{"database-name":"mosip_esignet_sunbird_2_0_0","database-username":"esignetuser_sunbird_2_0_0"}}' + +# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. +if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then + kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ + --from-literal=mosip-esignet-misp-key="" + echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" +fi + +echo "Creating esignet-captcha-sunbird-2-0-0 secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-sunbird-2-0-0 \ + --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying esignet-captcha-sunbird-2-0-0 secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-sunbird-2-0-0 "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETSUNBIRD secret key" +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD_2_0_0')].name}" 2>/dev/null || echo "") +if [[ -z "$ENV_VAR_EXISTS" ]]; then + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD_2_0_0", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-sunbird-2-0-0", "key": "esignet-captcha-secret-key"}}}}]' +else + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD_2_0_0 already exists." +fi + +echo "eSignet Sunbird pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh new file mode 100755 index 000000000..97259f342 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh @@ -0,0 +1,28 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Kafka Post-install +# ============================================================================= +# Based on: deploy/install-prereq.sh (kafka section) +# Creates kafka-config configmap in esignet namespace after Kafka deployment. +# +# Environment Variables: +# KAFKA_URL - Kafka bootstrap servers URL (default: internal kafka cluster) +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +KAFKA_URL="${KAFKA_URL:-kafka-0.kafka-headless.kafka.svc.cluster.local:9092,kafka-1.kafka-headless.kafka.svc.cluster.local:9092,kafka-2.kafka-headless.kafka.svc.cluster.local:9092}" + +echo "================================================" +echo "eSignet 1.7.1 - Kafka Post-install" +echo "================================================" + +# --- Create kafka-config configmap in esignet namespace --- +# Source: deploy/install-prereq.sh - kafka configmap creation +echo "Creating kafka-config configmap in $ESIGNET_NS namespace" +kubectl -n "$ESIGNET_NS" create configmap kafka-config \ + --from-literal=SPRING_KAFKA_BOOTSTRAP-SERVERS="$KAFKA_URL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Kafka post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh new file mode 100755 index 000000000..f912ea20f --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh @@ -0,0 +1,44 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Kernel Services Pre-install +# ============================================================================= +# Based on: esignet-signup/deploy/kernel/install.sh +# Creates kernel namespace, domain-config configmap, and optionally copies +# artifactory-share and config-server-share configmaps if available. +# +# This script is idempotent — safe to run multiple times (used as preInstall +# for authmanager, auditmanager, and otpmanager which run in parallel). +# +# Environment Variables: +# MOSIP_API_HOST - External API host (e.g. api.sandbox.xyz.net) +# MOSIP_API_INTERNAL_HOST - Internal API host (e.g. api-internal.sandbox.xyz.net) +# ============================================================================= +set -euo pipefail + +KERNEL_NS="kernel-2-0-0" +API_HOST="${MOSIP_API_HOST:-}" +API_INTERNAL_HOST="${MOSIP_API_INTERNAL_HOST:-}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Kernel Pre-install" +echo "================================================" + +# --- Step 1: Ensure kernel namespace exists with istio --- +kubectl create namespace "$KERNEL_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$KERNEL_NS" istio-injection=enabled --overwrite + +# --- Step 2: Create domain-config configmap --- +echo "Creating domain-config configmap in $KERNEL_NS" +kubectl -n "$KERNEL_NS" create configmap domain-config \ + --from-literal=mosip-api-host="$API_HOST" \ + --from-literal=mosip-api-internal-host="$API_INTERNAL_HOST" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- Step 3: Copy optional configmaps from artifactory and config-server --- +$COPY_UTIL configmap artifactory-share artifactory "$KERNEL_NS" 2>/dev/null || \ + echo "WARNING: artifactory-share not found in artifactory namespace, skipping" +$COPY_UTIL configmap config-server-share config-server "$KERNEL_NS" 2>/dev/null || \ + echo "WARNING: config-server-share not found in config-server namespace, skipping" + +echo "Kernel pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh new file mode 100755 index 000000000..9c371a90d --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh @@ -0,0 +1,103 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Keycloak Post-install (Keycloak Init) +# ============================================================================= +# Based on: deploy/keycloak/keycloak-init.sh + deploy/initialise-prereq.sh +# Copies keycloak configmaps/secrets to esignet namespace and runs +# keycloak-init helm chart to create eSignet-specific clients and roles. +# +# Environment Variables: +# INSTALLATION_DOMAIN - Base domain (default: sandbox.xyz.net) +# KEYCLOAK_INIT_VERSION - keycloak-init chart version (default: 12.0.2) +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +KEYCLOAK_NS="keycloak" +CHART_VERSION="${KEYCLOAK_INIT_VERSION:-12.0.2}" +INSTALLATION_DOMAIN="${INSTALLATION_DOMAIN:-sandbox.xyz.net}" +IAMHOST_URL="iam.${INSTALLATION_DOMAIN}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Keycloak Post-install (Init)" +echo "================================================" + +# --- Step 1: Copy keycloak configmaps and secrets to esignet namespace --- +echo "Copying keycloak configmaps and secrets to $ESIGNET_NS namespace" + +$COPY_UTIL configmap keycloak-host "$KEYCLOAK_NS" "$ESIGNET_NS" 2>/dev/null || { + echo "keycloak-host not found in $KEYCLOAK_NS - creating directly" + kubectl -n "$ESIGNET_NS" create configmap keycloak-host \ + --from-literal=keycloak-external-url="https://$IAMHOST_URL" \ + --from-literal=keycloak-internal-url="http://keycloak.$KEYCLOAK_NS" \ + --dry-run=client -o yaml | kubectl apply -f - +} + +$COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$ESIGNET_NS" 2>/dev/null || \ + echo "WARNING: keycloak-env-vars not found in $KEYCLOAK_NS" + +$COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" 2>/dev/null || \ + echo "WARNING: keycloak secret not found in $KEYCLOAK_NS" + +# --- Step 2: Read existing client secrets if any --- +echo "Checking for existing keycloak-client-secrets" +HELM_SET_SECRETS=() + +escape_helm_value() { + local value="$1" + value="${value//\\/\\\\}" + value="${value//,/\\,}" + value="${value//=/\\=}" + printf '%s' "$value" +} + +declare -A SECRET_KEYS=( + ["mosip_pms_client_secret"]="0" + ["mpartner_default_auth_secret"]="1" + ["mosip_ida_client_secret"]="2" + ["mosip_deployment_client_secret"]="3" + ["mpartner_default_mobile_secret"]="4" +) + +if kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets &>/dev/null; then + echo "Found existing keycloak-client-secrets. Preserving client secrets." + for key in "${!SECRET_KEYS[@]}"; do + idx="${SECRET_KEYS[$key]}" + val=$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.$key}" 2>/dev/null | base64 -d 2>/dev/null || echo "") + if [[ -n "$val" ]]; then + HELM_SET_SECRETS+=( + --set-string "clientSecrets[$idx].name=$key" + --set-string "clientSecrets[$idx].secret=$(escape_helm_value "$val")" + ) + fi + done +else + echo "No existing keycloak-client-secrets found. Fresh install." +fi + +# --- Step 3: Run keycloak-init helm chart --- +echo "Installing esignet-keycloak-init" +helm repo add mosip https://mosip.github.io/mosip-helm || true +helm repo update + +kubectl -n "$ESIGNET_NS" delete secret --ignore-not-found=true keycloak-client-secrets +helm -n "$ESIGNET_NS" delete esignet-keycloak-init 2>/dev/null || true + +helm -n "$ESIGNET_NS" install esignet-keycloak-init mosip/keycloak-init \ + ${HELM_SET_SECRETS[@]+"${HELM_SET_SECRETS[@]}"} \ + --set keycloak.realms.mosip.realm_config.attributes.frontendUrl="https://$IAMHOST_URL/auth" \ + --set keycloakInternalHost="keycloak.$KEYCLOAK_NS" \ + --set keycloakExternalHost="$IAMHOST_URL" \ + --version "$CHART_VERSION" --wait --wait-for-jobs + +# --- Step 4: Sync updated client secrets back to keycloak namespace --- +echo "Syncing keycloak-client-secrets back to $KEYCLOAK_NS namespace" +if kubectl -n "$ESIGNET_NS" get secret keycloak-client-secrets &>/dev/null; then + $COPY_UTIL secret keycloak-client-secrets "$ESIGNET_NS" "$KEYCLOAK_NS" + echo "keycloak-client-secrets synced to $KEYCLOAK_NS namespace." +fi + +echo "Keycloak post-install (init) completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh new file mode 100755 index 000000000..fd47fd8aa --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock Identity System DB Init Pre-install +# ============================================================================= +# Based on: esignet-mock-services/deploy/postgres/init_db.sh +# Ensures postgres-postgresql secret is present in the esignet namespace +# before postgres-init-mock-identity helm chart runs DB initialization. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +POSTGRES_NS="postgres" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Mock Identity DB Init Pre-install" +echo "================================================" + +# --- Step 1: Ensure esignet namespace exists with istio --- +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# --- Step 2: Copy postgres-postgresql secret to esignet namespace --- +echo "Copying postgres-postgresql secret to $ESIGNET_NS namespace" +$COPY_UTIL secret postgres-postgresql "$POSTGRES_NS" "$ESIGNET_NS" + +echo "Mock identity DB init pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh new file mode 100755 index 000000000..8dec26b46 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock Identity System Pre-install +# ============================================================================= +# Prepares esignet namespace for mock identity system deployment: +# - Copies softhsm-mock-identity-system secret from softhsm ns +# - Creates mockid-postgres-config with mock identity DB values +# - Verifies softhsm-mock-identity-system-share ConfigMap is present +# +# Environment Variables: +# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem) +# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser) +# MOCKID_DB_PORT - Postgres port (default: 5432) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +SOFTHSM_NS="softhsm-2-0-0" +MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem_2_0_0}" +MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser_2_0_0}" +MOCKID_DB_PORT="${MOCKID_DB_PORT:-5432}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Mock Identity System Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +# Copy softhsm-mock-identity-system secret to esignet ns +# The chart references it directly via secretKeyRef — pod and secret must be in same namespace +$COPY_UTIL secret softhsm-mock-identity-system-2-0-0 "$SOFTHSM_NS" "$ESIGNET_NS" +echo "softhsm-mock-identity-system-2-0-0 secret copied to $ESIGNET_NS." + +# Read internal host from postgres-config (already present from esignet-preinstall.sh) +DB_HOST=$(kubectl -n "$ESIGNET_NS" get configmap postgres-config \ + -o jsonpath='{.data.database-host}' 2>/dev/null || echo "") +if [ -z "$DB_HOST" ]; then + echo "ERROR: postgres-config not found in $ESIGNET_NS — ensure esignet-preinstall.sh has run." >&2 + exit 1 +fi + +# Build mockid-postgres-config — DB name/user/port are fixed for mock identity system +kubectl -n "$ESIGNET_NS" create configmap mockid-postgres-config \ + --from-literal=database-host="$DB_HOST" \ + --from-literal=database-port="$MOCKID_DB_PORT" \ + --from-literal=database-name="$MOCKID_DB_NAME" \ + --from-literal=database-username="$MOCKID_DB_USER" \ + --dry-run=client -o yaml | kubectl apply -f - +echo "mockid-postgres-config created/updated in $ESIGNET_NS (host=$DB_HOST db=$MOCKID_DB_NAME user=$MOCKID_DB_USER)." + +# Verify SoftHSM mock identity configmap exists in esignet namespace +if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-share &>/dev/null; then + echo "SoftHSM mock identity system configmap found." +else + echo "ERROR: softhsm-mock-identity-system-share configmap not found in $ESIGNET_NS namespace." + echo "Deploy softhsm-mock-identity-system-2-0-0 before running mock identity system install." + exit 1 +fi + +echo "Mock identity system pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh new file mode 100755 index 000000000..b7344e008 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock Relying Party Service MOSIPID1 Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service +# preinstall (creates private key secrets in the target namespace). +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-mosipid1-2-0-0" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh new file mode 100755 index 000000000..310443206 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock Relying Party Service MOSIPID2 Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service +# preinstall (creates private key secrets in the target namespace). +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-mosipid2-2-0-0" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh new file mode 100755 index 000000000..760dab3af --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh @@ -0,0 +1,73 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock Relying Party Service Pre-install +# ============================================================================= +# Creates K8s secrets for mock relying party private keys from GitHub Actions +# environment secrets, then verifies the esignet service is running. +# +# Required env vars (set in workflow env: block from GitHub Actions secrets): +# MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY — base64-encoded PEM client private key +# MOCK_RELYING_PARTY_JWE_PRIVATE_KEY — base64-encoded PEM JWE userinfo private key +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" + +CLIENT_KEY_TMPFILE="" +JWE_KEY_TMPFILE="" + +cleanup_temp_files() { + [ -n "$CLIENT_KEY_TMPFILE" ] && [ -f "$CLIENT_KEY_TMPFILE" ] && \ + { shred -u "$CLIENT_KEY_TMPFILE" 2>/dev/null || rm -f "$CLIENT_KEY_TMPFILE"; } + [ -n "$JWE_KEY_TMPFILE" ] && [ -f "$JWE_KEY_TMPFILE" ] && \ + { shred -u "$JWE_KEY_TMPFILE" 2>/dev/null || rm -f "$JWE_KEY_TMPFILE"; } +} +trap cleanup_temp_files EXIT INT TERM + +echo "================================================" +echo "eSignet 1.7.1 - Mock Relying Party Service Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +# Create mock-relying-party-private-key-jwk (client private key) +EXISTING=$(kubectl -n "$ESIGNET_NS" get secret mock-relying-party-private-key-jwk \ + -o jsonpath='{.data.client-private-key}' 2>/dev/null || echo "") +if [ -z "$EXISTING" ]; then + if [ -n "${MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY:-}" ]; then + CLIENT_KEY_TMPFILE=$(mktemp) + chmod 600 "$CLIENT_KEY_TMPFILE" + echo "$MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY" | base64 -d | sed "s/'//g" | sed -z 's/\n/\\n/g' > "$CLIENT_KEY_TMPFILE" + kubectl -n "$ESIGNET_NS" delete secret mock-relying-party-private-key-jwk --ignore-not-found=true + kubectl -n "$ESIGNET_NS" create secret generic mock-relying-party-private-key-jwk \ + --from-file=client-private-key="$CLIENT_KEY_TMPFILE" + echo "mock-relying-party-private-key-jwk created." + else + echo "ERROR: MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY is not set." >&2 + exit 1 + fi +else + echo "mock-relying-party-private-key-jwk already exists, skipping." +fi + +# Create jwe-userinfo-service-secrets (JWE userinfo private key) +EXISTING=$(kubectl -n "$ESIGNET_NS" get secret jwe-userinfo-service-secrets \ + -o jsonpath='{.data.jwe-userinfo-private-key}' 2>/dev/null || echo "") +if [ -z "$EXISTING" ]; then + if [ -n "${MOCK_RELYING_PARTY_JWE_PRIVATE_KEY:-}" ]; then + JWE_KEY_TMPFILE=$(mktemp) + chmod 600 "$JWE_KEY_TMPFILE" + echo "$MOCK_RELYING_PARTY_JWE_PRIVATE_KEY" | base64 -d | sed "s/'//g" | sed -z 's/\n/\\n/g' > "$JWE_KEY_TMPFILE" + kubectl -n "$ESIGNET_NS" delete secret jwe-userinfo-service-secrets --ignore-not-found=true + kubectl -n "$ESIGNET_NS" create secret generic jwe-userinfo-service-secrets \ + --from-file=jwe-userinfo-private-key="$JWE_KEY_TMPFILE" + echo "jwe-userinfo-service-secrets created." + else + echo "ERROR: MOCK_RELYING_PARTY_JWE_PRIVATE_KEY is not set." >&2 + exit 1 + fi +else + echo "jwe-userinfo-service-secrets already exists, skipping." +fi + +echo "Mock relying party service pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh new file mode 100755 index 000000000..74e3a40c2 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock Relying Party Service Sunbird Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base mock-rp-service +# preinstall (creates private key secrets in the target namespace). +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-sunbird-2-0-0" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh new file mode 100755 index 000000000..8617e09d6 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh @@ -0,0 +1,24 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install +# ============================================================================= +# Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service +# is available in the esignet-mosipid1 namespace before UI deployment. +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="esignet-mosipid1-2-0-0" + +echo "================================================" +echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-2-0-0 &>/dev/null; then + echo "Mock relying party service found in $ESIGNET_NS." +else + echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." +fi + +echo "Mock relying party UI MOSIPID1 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh new file mode 100755 index 000000000..e3446b839 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh @@ -0,0 +1,24 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install +# ============================================================================= +# Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service +# is available in the esignet-mosipid2 namespace before UI deployment. +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="esignet-mosipid2-2-0-0" + +echo "================================================" +echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-2-0-0 &>/dev/null; then + echo "Mock relying party service found in $ESIGNET_NS." +else + echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." +fi + +echo "Mock relying party UI MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh new file mode 100755 index 000000000..f64148d2f --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock Relying Party UI Pre-install +# ============================================================================= +# Prepares for mock relying party UI deployment. +# ============================================================================= +set -euo pipefail + +echo "================================================" +echo "eSignet 1.7.1 - Mock Relying Party UI Pre-install" +echo "================================================" + +# Ensure esignet namespace exists +kubectl create namespace esignet-mock-2-0-0 --dry-run=client -o yaml | kubectl apply -f - + +# Verify mock relying party service is available +if kubectl -n esignet-mock-2-0-0 get svc mock-relying-party-service-2-0-0 &>/dev/null; then + echo "Mock relying party service found." +else + echo "WARNING: Mock relying party service not found. UI depends on the service being deployed." +fi + +echo "Mock relying party UI pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh new file mode 100755 index 000000000..382b882b7 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh @@ -0,0 +1,24 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install +# ============================================================================= +# Ensures esignet-sunbird namespace exists and verifies mock-relying-party-service +# is available in the esignet-sunbird namespace before UI deployment. +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="esignet-sunbird-2-0-0" + +echo "================================================" +echo "eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-2-0-0 &>/dev/null; then + echo "Mock relying party service found in $ESIGNET_NS." +else + echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." +fi + +echo "Mock relying party UI Sunbird pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh new file mode 100755 index 000000000..ababd0847 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Notifier Post-install +# ============================================================================= +# Based on: esignet-signup/deploy/kernel/install.sh +# Patches notifier deployment with SMS number length env vars after install. +# ============================================================================= +set -euo pipefail + +KERNEL_NS="kernel-2-0-0" + +echo "================================================" +echo "eSignet 1.7.1 - Notifier Post-install" +echo "================================================" + +# Source: deploy/kernel/install.sh - kubectl set env deployment/notifier +echo "Setting SMS number length env vars on notifier-2-0-0 deployment" +kubectl -n "$KERNEL_NS" set env deployment/notifier-2-0-0 \ + MOSIP_KERNEL_SMS_NUMBER_MIN_LENGTH=7 \ + MOSIP_KERNEL_SMS_NUMBER_MAX_LENGTH=10 + +echo "Notifier post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh new file mode 100755 index 000000000..61e29f4c0 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - OIDC UI MOSIPID1 Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-mosipid1-2-0-0" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh new file mode 100755 index 000000000..cbb320f2d --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - OIDC UI MOSIPID2 Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base oidc-ui preinstall. +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-mosipid2-2-0-0" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh new file mode 100755 index 000000000..ccce694cf --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh @@ -0,0 +1,34 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - OIDC UI Pre-install +# ============================================================================= +# Based on: deploy/oidc-ui/install.sh +# Waits for eSignet service readiness before deploying OIDC UI. +# Theme, language, and provider name are configured via DSF helm set values. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" + +echo "================================================" +echo "eSignet 1.7.1 - OIDC UI Pre-install" +echo "================================================" + +# --- Step 1: Ensure esignet namespace exists --- +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# --- Step 2: Update helm repos --- +helm repo add mosip https://mosip.github.io/mosip-helm || true +helm repo update + +# --- Step 3: Wait for eSignet service to be available --- +# Source: deploy/oidc-ui/install.sh - eSignet must be running before OIDC UI +echo "Waiting for eSignet service to be ready..." +kubectl -n "$ESIGNET_NS" wait --for=condition=ready pod -l app.kubernetes.io/name=esignet --timeout=480s || \ + { echo "ERROR: eSignet pods not ready after timeout" >&2; exit 1; } + +echo "OIDC UI pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh new file mode 100755 index 000000000..b1fc1930b --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - OIDC UI Sunbird Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base oidc-ui preinstall. +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-sunbird-2-0-0" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh new file mode 100755 index 000000000..4168e280a --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh @@ -0,0 +1,45 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install +# ============================================================================= +# Creates the Istio Gateway for pms-partner in esignet-mosipid1 namespace. +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="esignet-mosipid1-2-0-0" + +echo "================================================" +echo "eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install" +echo "================================================" + +kubectl apply -f - < create_or_update_configmap() +echo "Creating postgres-config configmap in $POSTGRES_NS namespace" +kubectl -n "$POSTGRES_NS" create configmap postgres-config \ + --from-literal=database-host="$POSTGRES_HOST" \ + --from-literal=database-port="$POSTGRES_PORT" \ + --from-literal=database-username="$DB_USER" \ + --from-literal=database-name="$DB_NAME" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Postgres post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh new file mode 100755 index 000000000..8252fda13 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Postgres Pre-install +# ============================================================================= +# Based on: deploy/install-prereq.sh +# Creates esignet namespace, applies esignet-global configmap, and prepares +# postgres namespace before PostgreSQL helm chart deployment. +# +# Environment Variables: +# INSTALLATION_DOMAIN - Base domain (default: sandbox.xyz.net) +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +INSTALLATION_DOMAIN="${INSTALLATION_DOMAIN:-sandbox.xyz.net}" + +echo "================================================" +echo "eSignet 1.7.1 - Postgres Pre-install" +echo "================================================" + +# --- Step 1: Create esignet namespace (referenced by esignet-global configmap) --- +echo "Creating $ESIGNET_NS namespace" +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# --- Step 2: Prepare postgres namespace --- +echo "Creating postgres namespace" +kubectl create namespace postgres --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace postgres istio-injection=enabled --overwrite + +echo "Postgres pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh new file mode 100755 index 000000000..92b1d72e0 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Redis Post-install Setup +# ============================================================================= +# Based on: deploy/redis/install.sh + deploy/install-prereq.sh (redis section) +# Creates redis-config configmap and shares Redis credentials with the +# esignet namespace after Redis deployment. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +REDIS_NS="redis" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Redis Post-install Setup" +echo "================================================" + +# --- Step 1: Wait for Redis to be ready --- +echo "Waiting for Redis pods to be ready..." +kubectl -n "$REDIS_NS" wait --for=condition=ready pod -l app.kubernetes.io/name=redis --timeout=480s || \ + { echo "ERROR: Redis pods not ready after timeout" >&2; exit 1; } + +# --- Step 2: Apply redis-config configmap in redis namespace --- +echo "Creating redis-config configmap in $REDIS_NS namespace" +cat </dev/null; then + SECRET_B64=$(kubectl -n "$SIGNUP_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.$SECRET_KEY}" 2>/dev/null || echo "") + if [[ -n "$SECRET_B64" ]]; then + echo "Syncing $SECRET_KEY back to $KEYCLOAK_NS namespace" + if kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets &>/dev/null; then + kubectl -n "$KEYCLOAK_NS" patch secret keycloak-client-secrets \ + --type=merge \ + -p "{\"data\":{\"$SECRET_KEY\":\"$SECRET_B64\"}}" || true + else + kubectl -n "$KEYCLOAK_NS" create secret generic keycloak-client-secrets \ + --from-literal=dummy=placeholder \ + --dry-run=client -o yaml | kubectl apply -f - + kubectl -n "$KEYCLOAK_NS" patch secret keycloak-client-secrets \ + --type=merge \ + -p "{\"data\":{\"$SECRET_KEY\":\"$SECRET_B64\"}}" || true + fi + echo "$SECRET_KEY synced to $KEYCLOAK_NS namespace." + fi +fi + +echo "Signup keycloak init post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh new file mode 100755 index 000000000..48b10111a --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh @@ -0,0 +1,59 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Signup Keycloak Init Pre-install +# ============================================================================= +# Based on: esignet-signup/deploy/keycloak/keycloak-init.sh +# Copies keycloak configmaps/secrets to signup namespace and ensures +# keycloak-client-secrets contains mosip_signup_client_secret before +# the keycloak-init helm chart runs. +# +# On first deploy: generates a UUID secret if none exists in keycloak ns. +# On re-deploy: propagates the existing secret from keycloak namespace. +# +# Environment Variables: +# SIGNUP_NS - Signup namespace (default: signup) +# ============================================================================= +set -euo pipefail + +SIGNUP_NS="${SIGNUP_NS:-signup-2-0-0}" +KEYCLOAK_NS="keycloak" +SECRET_KEY="mosip_signup-2-0-0_client_secret" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Signup Keycloak Init Pre-install" +echo "================================================" + +# --- Step 1: Ensure signup namespace exists with istio --- +kubectl create namespace "$SIGNUP_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$SIGNUP_NS" istio-injection=enabled --overwrite + +# --- Step 2: Copy keycloak-env-vars configmap --- +echo "Copying keycloak-env-vars to $SIGNUP_NS namespace" +$COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$SIGNUP_NS" + +# --- Step 3: Copy keycloak secret --- +echo "Copying keycloak secret to $SIGNUP_NS namespace" +$COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$SIGNUP_NS" + +# --- Step 4: Ensure keycloak-client-secrets has mosip_signup_client_secret --- +echo "Ensuring mosip_signup-2-0-0_client_secret exists in $SIGNUP_NS" +if kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets &>/dev/null && \ + kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.$SECRET_KEY}" 2>/dev/null | grep -q '.'; then + echo "Found existing $SECRET_KEY in keycloak namespace — propagating to $SIGNUP_NS" + SECRET_B64=$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.$SECRET_KEY}") +else + echo "No existing $SECRET_KEY found — generating new secret" + SECRET_B64=$(python3 -c "import uuid, base64; print(base64.b64encode(str(uuid.uuid4()).encode()).decode())") +fi + +kubectl -n "$SIGNUP_NS" create secret generic keycloak-client-secrets \ + --from-literal=dummy=placeholder \ + --dry-run=client -o yaml | kubectl apply -f - +kubectl -n "$SIGNUP_NS" patch secret keycloak-client-secrets \ + --type=merge \ + -p "{\"data\":{\"$SECRET_KEY\":\"$SECRET_B64\"}}" + +echo "Signup keycloak init pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh new file mode 100755 index 000000000..945c25feb --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh @@ -0,0 +1,95 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Signup Service Pre-install +# ============================================================================= +# Based on: esignet-signup/deploy/prereq.sh + deploy/msg-gateway/install.sh +# Sets up all prerequisites for signup-service: +# - Copies redis-config configmap and redis secret +# - Creates keycloak-host configmap (KEYCLOAK_EXTERNAL_URL) +# - Creates empty signup-captcha secret (update site/secret keys for prod) +# - Creates empty signup-keystore and signup-keystore-password secrets +# - Creates msg-gateway configmap and secret (default: mock-smtp) +# +# Environment Variables: +# SIGNUP_NS - Signup namespace (default: signup) +# MOSIP_IAM_EXTERNAL_HOST - Keycloak external host (e.g. iam.sandbox.xyz.net) +# MOSIP_SIGNUP_CAPTCHA_SITE_KEY - reCAPTCHA site key (default: empty) +# MOSIP_SIGNUP_CAPTCHA_SECRET_KEY - reCAPTCHA secret key (default: empty) +# ============================================================================= +set -euo pipefail + +SIGNUP_NS="${SIGNUP_NS:-signup-2-0-0}" +REDIS_NS="redis" +KEYCLOAK_NS="keycloak" +IAM_EXTERNAL_HOST="${MOSIP_IAM_EXTERNAL_HOST:-}" +CAPTCHA_SITE_KEY="${MOSIP_SIGNUP_CAPTCHA_SITE_KEY:-}" +CAPTCHA_SECRET_KEY="${MOSIP_SIGNUP_CAPTCHA_SECRET_KEY:-}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Signup Service Pre-install" +echo "================================================" + +# --- Step 1: Ensure signup namespace exists with istio --- +kubectl create namespace "$SIGNUP_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$SIGNUP_NS" istio-injection=enabled --overwrite + +# --- Step 2: Copy redis configmap and secret --- +echo "Copying redis-config to $SIGNUP_NS namespace" +$COPY_UTIL configmap redis-config "$REDIS_NS" "$SIGNUP_NS" +echo "Copying redis secret to $SIGNUP_NS namespace" +$COPY_UTIL secret redis "$REDIS_NS" "$SIGNUP_NS" + +# --- Step 3: Create keycloak-host configmap --- +echo "Creating keycloak-host configmap in $SIGNUP_NS" +kubectl -n "$SIGNUP_NS" create configmap keycloak-host \ + --from-literal=keycloak-external-url="https://$IAM_EXTERNAL_HOST/auth" \ + --from-literal=keycloak-internal-url="http://keycloak.$KEYCLOAK_NS" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- Step 4: Create signup-captcha secret --- +echo "Creating signup-captcha secret in $SIGNUP_NS" +kubectl -n "$SIGNUP_NS" create secret generic signup-captcha \ + --from-literal=signup-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=signup-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying signup-captcha secret to captcha namespace" +$COPY_UTIL secret signup-captcha "$SIGNUP_NS" "captcha" + +echo "Patching captcha deployment with signup-2-0-0 secret key" +ENV_VAR_EXISTS=$(kubectl -n captcha get deployment captcha \ + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP')].name}" 2>/dev/null || echo "") +if [[ -z "$ENV_VAR_EXISTS" ]]; then + kubectl patch deployment -n captcha captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP", "valueFrom": {"secretKeyRef": {"name": "signup-captcha", "key": "signup-captcha-secret-key"}}}}]' +else + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP already exists." +fi + +# --- Step 5: Create signup-keystore secrets --- +echo "Creating signup-keystore secrets in $SIGNUP_NS" +kubectl -n "$SIGNUP_NS" create secret generic signup-keystore-password \ + --from-literal=signup-keystore-password='' \ + --dry-run=client -o yaml | kubectl apply -f - +kubectl -n "$SIGNUP_NS" create secret generic signup-keystore \ + --from-literal=oidckeystore.p12='' \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- Step 6: Create msg-gateway configmap and secret (pointing to mock-smtp) --- +echo "Creating msg-gateway configmap and secret in $SIGNUP_NS" +kubectl -n "$SIGNUP_NS" create configmap msg-gateway \ + --from-literal=smtp-host="mock-smtp-2-0-0.mock-smtp-2-0-0" \ + --from-literal=sms-host="mock-smtp-2-0-0.mock-smtp-2-0-0" \ + --from-literal=smtp-port="8025" \ + --from-literal=sms-port="8080" \ + --from-literal=smtp-username="" \ + --from-literal=sms-username="" \ + --dry-run=client -o yaml | kubectl apply -f - +kubectl -n "$SIGNUP_NS" create secret generic msg-gateway \ + --from-literal=smtp-secret='' \ + --from-literal=sms-secret='' \ + --from-literal=sms-authkey='authkey' \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Signup service pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh new file mode 100755 index 000000000..7b3ae0c44 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM eSignet MOSIPID1 Pre-install Setup +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base softhsm setup. +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-mosipid1-2-0-0" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh new file mode 100755 index 000000000..707ed2283 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM eSignet MOSIPID2 Pre-install Setup +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base softhsm setup. +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-mosipid2-2-0-0" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh new file mode 100755 index 000000000..36f098df9 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM eSignet Post-install +# ============================================================================= +# Based on: deploy/esignet/install.sh (copy_cm_func.sh calls for softhsm) +# Shares SoftHSM configmap and secrets from softhsm namespace to esignet +# namespace after SoftHSM deployment. +# +# Environment Variables: +# SOFTHSM_NS - SoftHSM namespace (default: softhsm) +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +SOFTHSM_NS="${SOFTHSM_NS:-softhsm-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - SoftHSM eSignet Post-install" +echo "================================================" + +# --- Step 1: Wait for SoftHSM pod to be ready --- +echo "Waiting for SoftHSM pod to be ready..." +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm-2-0-0 --timeout=480s || \ + { echo "ERROR: SoftHSM pod not ready after timeout" >&2; exit 1; } + +# --- Step 2: Copy esignet-softhsm-share configmap to esignet namespace --- +echo "Copying esignet-softhsm-share configmap to $ESIGNET_NS namespace" +$COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ + echo "WARNING: esignet-softhsm-share configmap not found in $SOFTHSM_NS" + +# --- Step 3: Copy esignet-softhsm secret to esignet namespace --- +echo "Copying esignet-softhsm-2-0-0 secret to $ESIGNET_NS namespace" +$COPY_UTIL secret esignet-softhsm-2-0-0 "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ + echo "WARNING: esignet-softhsm-2-0-0 secret not found in $SOFTHSM_NS" + +echo "SoftHSM eSignet post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh new file mode 100755 index 000000000..388038fed --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM eSignet Pre-install Setup +# ============================================================================= +# Based on: deploy/softhsm/install.sh +# softhsm-esignet deploys in the esignet namespace (v1.7.1 pattern) so +# esignet-softhsm-share configmap is created there directly — no cross-ns copy. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" + +echo "================================================" +echo "eSignet 1.7.1 - SoftHSM eSignet Pre-install" +echo "================================================" + +# Ensure esignet namespace exists with Istio injection enabled +echo "Ensuring $ESIGNET_NS namespace exists" +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# Update helm repos +echo "Updating helm repos" +helm repo update + +echo "SoftHSM eSignet pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh new file mode 100755 index 000000000..d3c83e3f2 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM eSignet Sunbird Pre-install Setup +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base softhsm setup. +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-sunbird-2-0-0" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh new file mode 100755 index 000000000..192ef4dfd --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM Mock Identity System Post-install +# ============================================================================= +# Copies chart-generated softhsm-mock-identity-system-share configmap +# (PKCS11 slot/token config) from softhsm namespace to esignet-mock namespace. +# The security PIN is handled separately via secret copy in preinstall. +# ============================================================================= +set -euo pipefail + +SOFTHSM_NS="${SOFTHSM_NS:-softhsm-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - SoftHSM Mock Identity System Post-install" +echo "================================================" + +# Wait for SoftHSM mock identity pod to be ready +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=softhsm-mock-identity-system-2-0-0 --timeout=480s || \ + { echo "ERROR: SoftHSM mock identity system pod not ready after timeout" >&2; exit 1; } + +# Copy chart-generated PKCS11 configmap to esignet-mock namespace +echo "Copying softhsm-mock-identity-system-share configmap to $ESIGNET_NS" +$COPY_UTIL configmap softhsm-mock-identity-system-share "$SOFTHSM_NS" "$ESIGNET_NS" + +echo "SoftHSM mock identity system post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh new file mode 100755 index 000000000..c05dcea21 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh @@ -0,0 +1,17 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM Mock Identity System Pre-install +# ============================================================================= +# Prepares SoftHSM for the mock identity system. +# ============================================================================= +set -euo pipefail + +echo "================================================" +echo "eSignet 1.7.1 - SoftHSM Mock Identity System Pre-install" +echo "================================================" + +# Ensure softhsm namespace exists +kubectl create namespace softhsm-2-0-0 --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace softhsm-2-0-0 istio-injection=enabled --overwrite + +echo "SoftHSM mock identity system pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh new file mode 100755 index 000000000..806aaa2ee --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh @@ -0,0 +1,92 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Trigger Testrig CronJobs +# ============================================================================= +# Immediately triggers testrig CronJobs after deployment: +# apitestrig → esignet-mock ns (cronjob-apitestrig-esignet-mock) +# signup-apitestrig → signup ns (if deployed) +# signup-uitestrig → signup-uitestrig ns (if deployed) +# ============================================================================= +set -euo pipefail + +CONTINUE_ON_FAILURE="${CONTINUE_ON_FAILURE:-true}" +JOB_TIMEOUT="${JOB_TIMEOUT:-5400}" +OVERALL_SUCCESS=true + +trigger_and_wait() { + local ns=$1 cronjob=$2 + + if ! kubectl get cronjob -n "$ns" "$cronjob" &>/dev/null; then + echo "⏭ CronJob $cronjob not found in $ns — skipping" + return 0 + fi + + local job_name="${cronjob}-manual-$(date +%s)" + echo "▶ Creating $job_name from $cronjob in $ns" + kubectl create job -n "$ns" "$job_name" --from="cronjob/$cronjob" + + local elapsed=0 + while [[ $elapsed -lt $JOB_TIMEOUT ]]; do + local complete=$(kubectl get job -n "$ns" "$job_name" \ + -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}' 2>/dev/null || echo "") + local failed=$(kubectl get job -n "$ns" "$job_name" \ + -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}' 2>/dev/null || echo "") + [[ "$complete" == "True" ]] && { echo "✓ $job_name completed successfully"; return 0; } + [[ "$failed" == "True" ]] && { + echo "✗ $job_name failed" >&2 + kubectl logs -n "$ns" -l "job-name=$job_name" --tail=50 2>/dev/null || true + return 1 + } + echo " ⏳ $job_name running (${elapsed}s elapsed)..." + sleep 10 + elapsed=$((elapsed + 10)) + done + + echo "✗ $job_name timed out after ${JOB_TIMEOUT}s" >&2 + return 1 +} + +trigger_all_in_ns() { + local ns=$1 + local cronjobs + cronjobs=$(kubectl get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "") + if [[ -z "$cronjobs" ]]; then + echo "⏭ No CronJobs found in $ns — skipping" + return 0 + fi + for cj in $cronjobs; do + trigger_and_wait "$ns" "$cj" || return 1 + done +} + +echo "================================================" +echo "eSignet 1.7.1 - Trigger Testrig CronJobs" +echo "================================================" + +echo "=== eSignet API Testrig (esignet-mock-2-0-0 ns) ===" +trigger_all_in_ns esignet-mock-2-0-0 || OVERALL_SUCCESS=false + +echo "=== eSignet-MOSIPID1 API Testrig (esignet-mosipid1-2-0-0 ns) ===" +trigger_all_in_ns esignet-mosipid1-2-0-0 || OVERALL_SUCCESS=false + +echo "=== eSignet-MOSIPID2 API Testrig (esignet-mosipid2-2-0-0 ns) ===" +trigger_all_in_ns esignet-mosipid2-2-0-0 || OVERALL_SUCCESS=false + +echo "=== eSignet-Sunbird API Testrig (esignet-sunbird-2-0-0 ns) ===" +trigger_all_in_ns esignet-sunbird-2-0-0 || OVERALL_SUCCESS=false + +echo "=== Signup API Testrig (signup-2-0-0 ns, if deployed) ===" +trigger_all_in_ns signup-2-0-0 || true + +echo "=== Signup UI Testrig (signup-uitestrig-2-0-0 ns, if deployed) ===" +trigger_all_in_ns signup-uitestrig-2-0-0 || true + +echo "" +echo "=== Testrig Execution Summary ===" +if [[ "$OVERALL_SUCCESS" == "true" ]]; then + echo "✓ All testrig jobs completed successfully" + exit 0 +else + echo "✗ One or more testrig jobs failed" + exit 1 +fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh new file mode 100755 index 000000000..64e6ad806 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh @@ -0,0 +1,34 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Signup UI Testrig Pre-install Setup +# ============================================================================= +# Prepares the signup-uitestrig namespace. +# Copies keycloak resources from keycloak ns, MinIO s3 secret from minio ns, +# and postgres-postgresql from postgres ns. +# Stale uitestrig CMs are deleted so the chart recreates them from set: values. +# ============================================================================= +set -euo pipefail + +NS=signup-uitestrig-2-0-0 +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Signup UI Testrig Pre-install" +echo "================================================" + +echo "Ensuring $NS namespace exists with Istio injection disabled" +kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$NS" istio-injection=disabled --overwrite + +echo "Deleting stale uitestrig configmaps in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 +kubectl -n "$NS" delete --ignore-not-found=true configmap db +kubectl -n "$NS" delete --ignore-not-found=true configmap uitestrig + +echo "Copying resources to $NS" +$COPY_UTIL configmap keycloak-host keycloak "$NS" +$COPY_UTIL secret keycloak-client-secrets keycloak "$NS" +$COPY_UTIL secret s3 minio "$NS" +$COPY_UTIL secret postgres-postgresql postgres "$NS" + +echo "Signup UI Testrig pre-install setup completed." diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 014d94fd3..edb9a1dfb 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -11,6 +11,14 @@ You do **not** need to run any commands on your local machine — everything run **Estimated time:** ~90–120 minutes end to end (Terraform ~30 min, external services ~20 min, eSignet ~25 min). +> **A second, isolated profile — `esignet-standalone-2.0.0`** — is also available in the `profile` dropdown of +> `helmsman_esignet.yml`, `helmsman_testrigs.yml`, and `helmsman_signup.yml`. It deploys its own namespaces, Helm +> releases, hostnames (suffixed `-2-0-0`), and databases, so it can run side by side with `esignet-standalone` in +> the same cluster without colliding. It shares the same external infrastructure (Postgres server, Keycloak, Redis, +> Kafka, Minio, Captcha instances) and Terraform profile — deploy/manage those via `helmsman_external.yml` and +> Terraform using the `esignet-standalone` profile as usual; there is no separate `esignet-standalone-2.0.0` entry +> for either of those. + --- ## Table of Contents From a2b23aa1814314b2ce7c0980da5ad4b2738bda9e Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 23 Jul 2026 17:43:29 +0530 Subject: [PATCH 002/127] fix: #302 Wire up isolated captcha secret/env-var for the esignet-standalone-2.0.0 base instance, which was previously missing since its setup lived in the shared external-dsf.yaml captcha postInstall hook rather than its own DSF app hooks. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 1 + .../captcha-postinstall.sh | 20 +++++++++---------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 1e786dd10..06317ebde 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -135,6 +135,7 @@ apps: priority: -14 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh" esignet-mosipid1-2-0-0: namespace: esignet-mosipid1-2-0-0 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh index 1d439c4b0..2d0f4267e 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh @@ -24,22 +24,22 @@ echo "eSignet 1.7.1 - Captcha Post-install" echo "================================================" # --- Step 1: Create captcha secrets for eSignet --- -echo "Creating esignet-captcha secret in $ESIGNET_NS namespace" -kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha \ - --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ +echo "Creating esignet-captcha-2-0-0 secret in $ESIGNET_NS namespace" +kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha-2-0-0 \ + --from-literal=esignet-captcha-2-0-0-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=esignet-captcha-2-0-0-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - # --- Step 2: Copy captcha secret to captcha namespace --- -echo "Copying esignet-captcha secret to $CAPTCHA_NS namespace" -$COPY_UTIL secret esignet-captcha "$ESIGNET_NS" "$CAPTCHA_NS" +echo "Copying esignet-captcha-2-0-0 secret to $CAPTCHA_NS namespace" +$COPY_UTIL secret esignet-captcha-2-0-0 "$ESIGNET_NS" "$CAPTCHA_NS" # --- Step 3: Patch captcha deployment with secret env var --- echo "Patching captcha deployment with secret key environment variable" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET')].name}" 2>/dev/null || echo "") +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_2_0_0')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then - echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var..." + echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_2_0_0 env var..." ENV_ARRAY_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ -o jsonpath="{.spec.template.spec.containers[0].env}" 2>/dev/null || echo "") if [[ -z "$ENV_ARRAY_EXISTS" ]]; then @@ -48,9 +48,9 @@ if [[ -z "$ENV_VAR_EXISTS" ]]; then -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env", "value": []}]' fi kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_2_0_0", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-2-0-0", "key": "esignet-captcha-2-0-0-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_2_0_0 env var already exists." fi echo "Captcha post-install completed." From 51d667365ff513f07c19b74f8345567e263a348b Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 23 Jul 2026 18:03:22 +0530 Subject: [PATCH 003/127] fix: #302 Isolate signup-captcha secret/env-var for esignet-standalone-2.0.0 (same collision class as the earlier esignet-captcha fix, but live), and revert an over-eager rename of mosip_signup_client_secret since both profiles share the same hardcoded Keycloak client. Signed-off-by: bhumi46 --- .../signup-keycloak-init-postinstall.sh | 2 +- .../signup-keycloak-init-preinstall.sh | 4 ++-- .../signup-service-preinstall.sh | 22 +++++++++---------- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh index a640593d3..4afa3dade 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh @@ -13,7 +13,7 @@ set -euo pipefail SIGNUP_NS="${SIGNUP_NS:-signup-2-0-0}" KEYCLOAK_NS="keycloak" -SECRET_KEY="mosip_signup-2-0-0_client_secret" +SECRET_KEY="mosip_signup_client_secret" echo "================================================" echo "eSignet 1.7.1 - Signup Keycloak Init Post-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh index 48b10111a..c7a206ce9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh @@ -17,7 +17,7 @@ set -euo pipefail SIGNUP_NS="${SIGNUP_NS:-signup-2-0-0}" KEYCLOAK_NS="keycloak" -SECRET_KEY="mosip_signup-2-0-0_client_secret" +SECRET_KEY="mosip_signup_client_secret" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" @@ -37,7 +37,7 @@ echo "Copying keycloak secret to $SIGNUP_NS namespace" $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$SIGNUP_NS" # --- Step 4: Ensure keycloak-client-secrets has mosip_signup_client_secret --- -echo "Ensuring mosip_signup-2-0-0_client_secret exists in $SIGNUP_NS" +echo "Ensuring mosip_signup_client_secret exists in $SIGNUP_NS" if kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets &>/dev/null && \ kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ -o jsonpath="{.data.$SECRET_KEY}" 2>/dev/null | grep -q '.'; then diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh index 945c25feb..0ff1461b5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh @@ -6,7 +6,7 @@ # Sets up all prerequisites for signup-service: # - Copies redis-config configmap and redis secret # - Creates keycloak-host configmap (KEYCLOAK_EXTERNAL_URL) -# - Creates empty signup-captcha secret (update site/secret keys for prod) +# - Creates empty signup-captcha-2-0-0 secret (update site/secret keys for prod) # - Creates empty signup-keystore and signup-keystore-password secrets # - Creates msg-gateway configmap and secret (default: mock-smtp) # @@ -47,24 +47,24 @@ kubectl -n "$SIGNUP_NS" create configmap keycloak-host \ --from-literal=keycloak-internal-url="http://keycloak.$KEYCLOAK_NS" \ --dry-run=client -o yaml | kubectl apply -f - -# --- Step 4: Create signup-captcha secret --- -echo "Creating signup-captcha secret in $SIGNUP_NS" -kubectl -n "$SIGNUP_NS" create secret generic signup-captcha \ - --from-literal=signup-captcha-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=signup-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ +# --- Step 4: Create signup-captcha-2-0-0 secret --- +echo "Creating signup-captcha-2-0-0 secret in $SIGNUP_NS" +kubectl -n "$SIGNUP_NS" create secret generic signup-captcha-2-0-0 \ + --from-literal=signup-captcha-2-0-0-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=signup-captcha-2-0-0-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying signup-captcha secret to captcha namespace" -$COPY_UTIL secret signup-captcha "$SIGNUP_NS" "captcha" +echo "Copying signup-captcha-2-0-0 secret to captcha namespace" +$COPY_UTIL secret signup-captcha-2-0-0 "$SIGNUP_NS" "captcha" echo "Patching captcha deployment with signup-2-0-0 secret key" ENV_VAR_EXISTS=$(kubectl -n captcha get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_2_0_0')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n captcha captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP", "valueFrom": {"secretKeyRef": {"name": "signup-captcha", "key": "signup-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_2_0_0", "valueFrom": {"secretKeyRef": {"name": "signup-captcha-2-0-0", "key": "signup-captcha-2-0-0-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_2_0_0 already exists." fi # --- Step 5: Create signup-keystore secrets --- From 206b31984e11ca8bb45fc181916e7be7204a3962 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 23 Jul 2026 18:15:10 +0530 Subject: [PATCH 004/127] fix: #302 Add DNS subdomains for the isolated esignet-standalone-2.0.0 profile's public hostnames to the shared esignet-standalone terraform profile. Signed-off-by: bhumi46 --- .../aws/infra/profiles/esignet-standalone/aws.tfvars | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index a5b60172f..eea3731b4 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -77,8 +77,11 @@ enable_rancher_import = true rancher_import_url = "\"\"" # DNS Records to map — only eSignet-relevant subdomains +# Includes hosts for both the esignet-standalone profile and the isolated +# esignet-standalone-2.0.0 profile (suffixed "-2-0-0"), since both are deployed +# side-by-side against this same cluster/domain. -subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid1", "esignet-mosipid1", "pms-mosipid1", "signup-mosipid1", "healthservices-mosipid2", "esignet-mosipid2", "pms-mosipid2", "signup-mosipid2"] +subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid1", "esignet-mosipid1", "pms-mosipid1", "signup-mosipid1", "healthservices-mosipid2", "esignet-mosipid2", "pms-mosipid2", "signup-mosipid2", "esignet-2-0-0", "healthservices-2-0-0", "signup-2-0-0", "esignet-sunbird-2-0-0", "healthservices-sunbird-2-0-0", "healthservices-mosipid1-2-0-0", "esignet-mosipid1-2-0-0", "pms-mosipid1-2-0-0", "signup-mosipid1-2-0-0", "healthservices-mosipid2-2-0-0", "esignet-mosipid2-2-0-0", "pms-mosipid2-2-0-0", "signup-mosipid2-2-0-0"] subdomain_internal = ["iam", "activemq", "kafka", "kibana", "postgres", "smtp", "pmp", "minio"] # PostgreSQL Configuration From aba3fa412bc03a2b9f891d0569309f484a7e44e1 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Thu, 23 Jul 2026 18:50:45 +0530 Subject: [PATCH 005/127] Update aws.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../profiles/esignet-standalone/aws.tfvars | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index eea3731b4..d896b386e 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -7,22 +7,22 @@ # ============================================================ # Environment name (infra component) -cluster_name = "" +cluster_name = "esgotest" # eSignet's domain (ex: esignet.xyz.net) -cluster_env_domain = "" +cluster_env_domain = "esgotest.mosip.net" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = "" +mosip_email_id = "thisisbn46@gmail.com" # SSH login key name for AWS node instances (ex: my-ssh-key) -ssh_key_name = "" +ssh_key_name = "mosip-aws" # The AWS region for resource creation aws_provider_region = "ap-south-1" # Specific availability zones for VM deployment (optional) -specific_availability_zones = [] +specific_availability_zones = ["ap-south-1b"] # The instance type for Kubernetes nodes (control plane, worker, etcd) # Smaller instance type since eSignet standalone needs fewer resources @@ -32,7 +32,7 @@ k8s_instance_type = "t3a.2xlarge" nginx_instance_type = "t3a.2xlarge" # The Route 53 hosted zone ID -zone_id = "" +zone_id = "Z090954828SJIEL6P5406" ## UBUNTU 24.04 # The Amazon Machine Image ID for the instances @@ -63,7 +63,7 @@ k8s_control_plane_node_count = 1 k8s_etcd_node_count = 1 # Worker -k8s_worker_node_count = 2 +k8s_worker_node_count = 4 # RKE2 Version Configuration rke2_version = "v1.28.9+rke2r1" @@ -74,7 +74,7 @@ WIREGUARD_CIDR = "172.0.0.0/8" # Use your actual WireGuard VPN CIDR # Rancher Import Configuration enable_rancher_import = true -rancher_import_url = "\"\"" +rancher_import_url = "" # DNS Records to map — only eSignet-relevant subdomains # Includes hosts for both the esignet-standalone profile and the isolated @@ -94,7 +94,7 @@ postgresql_port = "5433" # MOSIP Infrastructure Repository Configuration mosip_infra_repo_url = "https://github.com/mosip/infra.git" -mosip_infra_branch = "develop" +mosip_infra_branch = "es-go-test" # VPC Configuration - Existing VPC to use (discovered by Name tag) vpc_name = "" From d6904b27516b3996ce3c83c81c08f97c633cf581 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 23 Jul 2026 13:23:18 +0000 Subject: [PATCH 006/127] Terraform files (encrypted state) GitHub Actions - aws-infra Signed-off-by: bhumi46 --- .github/scripts/rancher-grant-cluster-access.sh | 0 .github/scripts/rancher-register-cluster.sh | 0 terraform/implementations/aws/infra/backend.tf | 2 +- .../aws/infra/rancher-override.tfvars | 2 ++ terraform/implementations/aws/infra/tf-plan.gpg | Bin 0 -> 50542 bytes 5 files changed, 3 insertions(+), 1 deletion(-) mode change 100644 => 100755 .github/scripts/rancher-grant-cluster-access.sh mode change 100644 => 100755 .github/scripts/rancher-register-cluster.sh create mode 100644 terraform/implementations/aws/infra/rancher-override.tfvars create mode 100644 terraform/implementations/aws/infra/tf-plan.gpg diff --git a/.github/scripts/rancher-grant-cluster-access.sh b/.github/scripts/rancher-grant-cluster-access.sh old mode 100644 new mode 100755 diff --git a/.github/scripts/rancher-register-cluster.sh b/.github/scripts/rancher-register-cluster.sh old mode 100644 new mode 100755 diff --git a/terraform/implementations/aws/infra/backend.tf b/terraform/implementations/aws/infra/backend.tf index 59c22cf6f..ff4cc9846 100644 --- a/terraform/implementations/aws/infra/backend.tf +++ b/terraform/implementations/aws/infra/backend.tf @@ -1,5 +1,5 @@ terraform { backend "local" { - path = "profiles/mosip/aws-infra-mosip-develop-terraform.tfstate" + path = "profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate" } } diff --git a/terraform/implementations/aws/infra/rancher-override.tfvars b/terraform/implementations/aws/infra/rancher-override.tfvars new file mode 100644 index 000000000..da1b2e2eb --- /dev/null +++ b/terraform/implementations/aws/infra/rancher-override.tfvars @@ -0,0 +1,2 @@ +enable_rancher_import = true +rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/f25prw8zrsc959n2bk25mn79twtwmpq6hpxphf9xt97dhbm797r99n_c-stb2m.yaml\"" diff --git a/terraform/implementations/aws/infra/tf-plan.gpg b/terraform/implementations/aws/infra/tf-plan.gpg new file mode 100644 index 0000000000000000000000000000000000000000..28e40c9076610d0feeef398df13f389dd4d1fe5a GIT binary patch literal 50542 zcmV(nK=Qwg4Fm}T3O#40OcJ$SJCPrEGvW5Cjw39TiDJTWpXeK{vk|No~GQ1yq7V=N4ODivS!Hq&D0JA_&nqXmXl#i&05qM;wG7=6%0Rn{Sr)B#Xl{BsH)s(j5R ze;!4TJpC&pe2D={KkJ%HCJtnz__>q9fTim}L}wEK&LYLC+@XOTVj^~76ix&xGEt@}1py%D8s+rKZXh105C5Ws%@8GCWq!H;XziF|R}e zb<`*4q7w;L(D{VF(Jo?Uj9A7jFv|kSr+6gX@@k`IOjum}(m-U!T4T-;a#{I3&-fly zHx%>DfyvO*r}T7R9DSr%gGL>wqR6~Tr&)F5`tjs?Y`nXaOKbhKS0Bi!xL*>Q;AC?F zLsi(}&ypC*LYsK#W*NruDWQ-)wybAkj< z1nuf1R*|YQ>2wr9tgi?+EB)84U9uqIjP4Y_Z!hYz=JI8_ixL+sg1Vi?3!_Ol*pB8Q zVk9WnV}OInHW6Vy^p>6fUBqcwgy#4ub`gRN`!f-l?c@tV$mezy?W#mE05PFw3eTa_ zEl25hzDj+Yk}1=~^;ESZ(cM?ARTHBOd=HX*7pJ{A8dKf=!2dU#eia=!>JS($2X!et zqpd(T&^kV<-RZ3#MF?7<-{?hdL?eEur77>XGIpMjqj-VYtb2#3Tn4pi7aZ+KBVUgh z%Qhx`)C@>8{jQ4O02Hq2ERKS1FY7g|eR)!hNc9$D#=04ZLpUC<0^^0tCc8*57Z2i+ zQZ~lII#E^YSxKrb^7h{Cg(6O(FFOjd;y2IQS-F6Gjx;R#Wh z^*3u0U#4l+`PYZ@_TCxtalN_c^rqlKM()Y#`s-RX7nx2ZSkezZrcVjOhi+jxMSob< zF&;iwwkup7*thB4!)Fg3eo&FIF>k4Y!02=1CJ0=-335Vgx7L-}Y3^mu=x|Z+%P0fs zU&5u6)2oM45VKgu{P{{Zcu$>+eM>g!d-%wSbo}!d#xaTHdhS^|0KY{Es#@ww)S<_? z$`^=KJCaFnBv~!xWSw zjN<)fbF8R55A9Y7x&VY0MR-OjoyiI&@g=eK&qYXi?7-iQocZiWQHd~b*aWRvElGxBl4Q6SF;5}J?uy*k)NzRtmD`d# zfV*67{3CiY6`K2mw$9|`sg@)pGS373JOM9w2G{=<_7lKsf!vY)^PgiPXNpEg zbt%J)B%_kg2*G$vO53ms3lEXJo;QmOUm4M4aXyIN=I~#Z2L|_c-Rew;fbb;NNGC(6 zCKqFFO7&p@B{IZ^s7UsCF$L%3m)VzeG$MQ4s{{-+X0QIh!dR&9%VHe~i#0Zy>^nOM zQ7BWt_OM=;w zdwc-8tz(CTp`tzOT#g{44;=dCzD;sBri>-E#;tBv*nhR`4FaTlA#t|W?OFjDXlMrZ zr8kzXI*Sp`wA=x#2_-1*i@o;L zTLCdYzfeXOldEmD7zo7YFv~qrnuGhdBGcu+bhMlqQinkN!)GCelb3Ja5dO9!$Ws>M zsTg;QT)CwJMu}EH+Zb0b7jZ#cCRV!!gXGI5KyQ~a#TihS;9F>z7nWt*g42sy#48hv zC5MIP`u7COw4Yk=JkfE&^2I_!<-6|q1iUH@=&)l%rixqx;@PPnDzEQi#F)98Gz|oI zm@le3DCR&@dT&c9uis$|P7|vP@K(yOMf5pA z1h3mS`DgH~)4+A-q~hZ%oI9tL%(wF@BfTc%VkNny#!N=QQ)KhzlJ>xJQP zy{!A}RM`cQ%(z=NvJU+O>W95y>b13*)wT0!TMUxXb+)zFDVprJ^r$7!e4KOZH`1sX z@WZ6~>Ra03CRBp^(mNsHKmX+2b#P8zkDH*eFP^W49qN%<+dI*>w7f+K-$M|*L<8z& z4pEV-A+V}sIMXN@;$y{Nq?1jk*UOVy*Qw(n6G6Q4G#blQ$Q*e)RVP8f^g_A97 zRZSI!r$&g%of{4HeH@?XibD)fQqSI1NsoNnFY6>VA7Ytn?n6Riskr<(s6H)y9ymqC zIC8l%{=i+$!ZxzBphb-_`_ z4hid#2*LoQTFE$;HPE{!PG=HnxO0)9G0arj3(f5r{5grMWepW2n4f}=sW|=#fmFQ7 z)8SlRUU$0$?c<78kDv8n%@KQ+LWI>bjszW&cf2cD%W%fN=S?N6`$V$kI^lI&m<#pB z0VRL7mG4j1GrZx{LKJg?T=r&=-lq6I3^-C5(JT@MyaD&b3^hB!T)ortyPYz=pWNfQ zI5~Gyo&buefHRi#UIRkBPt=o#?rX*ijV_5vnA;(!{S~W^sj?kI&)=Z)Y)r#bcjK`8 zKeEtUd;*^}r;!lXBNSx8%2F$67qZ<{Kns?aAT1~mtWi+2G_=z|gc%`G*CXa#SA zwiFXs$>au|Pj?!^I$ZL(*S!YRm>6s7rGtuy0N#4bfb85uiqh&vA$-B>7=>93Fc4?QuQI37OR@nc)=6A)mQ0{5<8LTUle(sELP#*5&oYf?$b5J!-VyGu ziP}_`{c2#4!wpDLlqFp|5cyAOpJda-{60gEMvieR;zFNZ)Y(%s=K|ms_l@WT`i5gd z-)ZXEY)1(U6^0cqOQ6?BwwYjeW_UHO2_B4PKJ$mWx|o%)s2UFhXhb|o14N2~x3H4u z-^>+awe46|K|mn1=YRb)OoZ>w-;nu<{>x1H%eWnS7XL8kPdD9->bmHt%^I-*wA-9F zQcd@;RcnAXDL<6x*ng zWTx9L!{K_FN^m!FVE=oz^sq!zmIA8S#sf+>FhVde@ov@MGvsMYS>Ji#;6(gICCROV zE2VH5_M?CwXNdBc=!NFz7JCIwysd+g>eA(v>t?ByXjz{^m!_+V5DD> z9^i%scuDdA2-CBIyD4286$DWuKCwOrC#< zq8LWFXwY%5_kdorH@Q87=~RN=YnzoeK?MHniyp!6mo!V&WC+=GXwbvQJK6$+EvU*i z7BkqRN27up*Q2io9Yq@%&TD{2N^dAwX9`P75@BG{{5sO zY?xjm{~|2}V%CrTgzx?dF&hKn?^z%hQ9a+p&l=bSi7qiqiz=vO-H;ydPALXYWtHA|I>gSl`H zwwJ|aS))x+!4&`GK+@0iSDrpMVQSn^t;y`-`CcjVYY&ccxw>B1YcG+5|J&vz-VNxk zr)^Xh?aJJ|q|MXY%sw4XasDt-`HD6hI#{S~JLG_}5?G70cc_is(*!JBJ1YUcRC-y3 z5)1D!qN8NTML5Sgl$IcI7Hz;ty?l+033HmwQknzbYoqJDBCTHZD@6Uz_D4zY(~D2B zalv7JyYnDg>-stwQ`OiT`DX@S|Es|pvXec4>WbYWmHOI*Lcj>GnBtlt$R(zOBSjE` z&1t{&xuf+sE#c~JiXD3A4mT<;MGuc&&6XlE`6ow+O$Yc{G5=U5n~cDe3>Qoz0J7nZ zw`0bNKhY5$&qPU$afOUloKxR-Fx8pTlMhfg&};4UJ@XGs)@Fs+jjiQCvAPuebA*@@ zq+EG)qGKTb%}~19N)cb$a)&M_$leE=LCG~(TV6Yj9Lt<2R8)^X6$As?i^?2jw)E{lO!P%LA9?8PO8R%PqUJX zzAKu()3xXxy#wCbUMCG${pJ9e#R)T5NOLO-X?b|EP9B4m=~2EOHJinPIhmkU+x^oV zKudgWb;$-DdHpW1f+1=jl`?Cm4vX@aB`SkET_2 zgz?!{Y=dt&)mjX@W6g@w**n~vXSd%`IZN;FbZ$|Sb zOoB_+OB8F_lrD>K?_Loou%J;%SW-LRwA1Z&7RdIuc*N<&He1*PP4)k)?6ldt#b2=h zyyFc=L`|%*(<7CS3U3y~x;VyFaHZ5!8x2qMPPO8b{VEq56q6Aa;vdAvWxED3h2b!Q z1?X7yqQkt_#e+>})HI+F9*j6VV8^XyZf4HA@6$t$Ep+4b>kwcpGLRI=C|BO8Vxwyiji%-c!)}!$GTq#vf6;!` zy942ZP?x!Z!v5tU29#sL!nHR5+cq{@0wIddIAj!#xJj>wk>?@Ohb^n~4zT@n4tw}} zi{+L4jZo^j{%cYWt3K9@x5vk815`+9t*B;Icn6+4ri!#VLFYEnBJL{)7*DS= z3z!}TT|Cu5SD5t9CO)}O-S96GiG*T4gTh(yCAz`RtWzhk@pR^uO};c%A#XyXVs-!# z!2X=kbIpC1Tt7dR=zt(Qj5`!c4&#(?w#+zq75~irzcS-StqL~Gxc8TN`rmi=w)Jx? zaQp92%>vFHFA7iSS>%&`ZcMGTl;T;N1whF`@t}0vWJ&rNw;*}gso84BH4u2n zj09%s@l{zX7(bEViUm%sd112a8fJLP>oG@MTqcX2Jd?PZCU0U4y5zyB{}1p>+Rmftk3x~LFLzbmULZ`-Q)T{K?nLe3!8Wt_B#iQ&z)Y(;7A~G;j0kmyqjEX* zX9R@D$mT!2pij8vM1KMqJrB=~PEqwH0S-wB>*C96K-B8cocbr=hs zcmXTu~8b@Ytq;>9tU%nQ()RN*A!w_`XI+Q}?3An194iYxfW7%!c=!4+V(f z;oIhwC>lVM>Mvi%dHVgqF6_p4d4?~)(A8-kmncAqU z@YGtTOTZvJ!KWB##Vsij-rvLq?8xaHa#Z`Bbe5NF;y>n)%P$JL#6ia=u_=f1*K%ed zQQ0)mZ-e7m&l7FZE??vz5og3Nf8um3w3HjvvAHhD=@AV*^WZ`~%r^JgajWrD20Kp! zzt;IKY8F$Ifd?L&*T+XlVUkYC*pd`>DMzgK%lMjXo6!S3-ERQw0C&@Tz0tmgKeWw` z)qcajHdi1UC>i{NG&2Y}SY7}^$!)qIjLw+j_c#gjKSpj&Q2)T-TWeqRF)&E4RbtdJ z-KG^V24Z8NlmN4_G52NIyB*(w71|$yO$C`98rt(>W=a)S;<+)|%sWGHu6SGtY9O+o znMWI!sjL)qB5SH`m*qI4fQ280Vxst@)X8duoljnRxV=LDz$<2^n9&q10)R9Rd|j$B zk~d%Ajid$ujgEoqgmkY7H9N_2d{9^rMIQ1ph0vD~)1=0JTD@;Sjl0-HIuNw1wa4#P z$SocT%ec5|#bykmNN|%nVc>1M83S%Dlb>+wRI%o^UiwHZzo!NnpaF+5$-tchyN`I6 znPS6jAkYol%PitOf#>P*OP6q*Yszafj(PK!f|S^M+c3|XTh_?$b#f56>%PDEs>MoM z8IN_BPp$@?h@`lQhV^E<-0K1*=H=Ky=;LR?W^h2Nl%AC=fE9i_;UWY^x?n=|4x;|5jm*0oR48p>$fVWyXJA^C@?2lORnF`Pg z=>c%6&I9HCa2UIh`V!H4oCq3lb3*{=&Ur@S`VZYvm9x$!ZyESi@%gKWD2p{BGnV`5 z@WM%pz-Sgr^@34efgR1+h}T%p{^WSBRumS)slR`3BsWa(9@xR)YWSzT+iw6OX-o+4r)7up6NcpUf6+7Fj zkkeljaUJrf?4z5o#=@Ia!fR$8t^F8?>b)QC?k6EMef~o&EN#I`E@p}Ne#Na#s|AGv zpFx~Y@a9Xz=pI)E$X@lD?MW3}0d1EEEYii9woH`)Hjln9BfYd?{Fe#++EKFJ;U@K{AKO(ji>zX%h(1=n_-j=HNo-WMj%jbn zFfeq@+-@?|H**1{fU1fddandUT{mFc8hM46E)8#$;}s@#SMMqE26IjMywmADI!KK0 zN%TkIOWga3%F-8NOaFNHyMhWwPyJa*KZP_hgo?LW) z=Lzr+lBo=R?CkBZOb_W#h+_C7?!vD` z*ZcIa_B1MdrRCdHTsYym?lE*Wr!c6H9DWb4VeGM&xS~v+(}gLcSY(t-sHrM^EfBJA z>5v5#<^N}VF3b^Ffe3%`j|-j#rzbb-%d_7t*0q>%jr2aUX2ZGQ0;b*wgB3tuvkAnF zQ%6Lcl*BN@wozSF9t5**ERh3qoO^lPN{(ez3(T_&jhh`Nwu(_lxR6rk!c#83~psiK$th7K+yXaUh(ptlQaB*x5fiDVWPp0?ZX5)2H0o|~l z{RcaN{{o@IR@&q|GtC=u1$v$n)|)2vCJAESr0`j08Hz4Uk??AOa6Z}d2c&AQ#C#Cy zOHX&b0qb^Y$5TAEKYa$(xxZqFo$mn-Y)Wnss&e@#KQy*IX;v(t8A$~o+9OplG1fT` z!^0Rv2@of#ddNC+??pR2&8_aPDM5t2fy2ESLV{-4MLjA4$40!kvUnS{9{-`zK5;4l zEJCu8!c&v?s@a7GJPH>+xYo34WX9DL#qSTw!a84-$xxNYG^>YD@2}WgS}Wyx-M=}H!up1UNFX!54k)zLH}s*5o&zV(PlP(BK~NbRi=m{OP6nbcf} zylr|um*~w{e|vvl|I(zQCdNbS&O01`u!>U?40bFbcn>8 z$=EhW&~v2ou8elGz+vqKgrmn7EGfKJ>IgM}kf1?y92~;QtdO97m?Y zj_hRLnWp$G&ck~+8{owZgh9nCykAaldZ2=Lv(P$+b*NAWz$dL&mIJ@$F8b#+fP2yj-FE#B+xgQd>$( zEInxBOb1ggrho=iOC15MC=5FErRSX3fg;_^TXroiN=a=nK}FH~^WQFe-^{MOij@ON zj21S<=k1S3I~oZ=7av7kL%E4?%}?vQVVF>@?C5{*K8(g!UM2SM(Sst&NGvR`q_=S^ zmhVWZwrAH8#HlS4sT(*O-JGMKWhUW#N=X=+??l)*X80c2IO{(TbO^gsSiWRisuqov zO{7`sOQ&fjpcR5MA)2X#vkp?s)5mI4tYZOnlDZ~yj`-(v#FxY<40JODD*zYD<@uj3d^d^+A)#GZ$*X%vfBY}6DGdWFy8^!o7YJ`>Vb)#pLS1Ig^hJ5 z`+eNGf0Gbg&{ie!0I?)WIzFa>{v~%jSy>1O00faN@BJd@h2 zq9PD#K|a=<>D_1~KWjzNbahuwS_l4DH3-J&P5Lvw_}-n4;6FO=@qihXcimOw(1zpI zofpJJQTi3+VQl%4;I00mc7VjIU%}D3pv%GqiOW=0c9ZRG6q$bl9M{T;da`)1m(K?tc*A;^c1<2o+~qB-}6^1+yK9j>15WI<;ZxD5-aM2EvNv@F}J83fn!y+LLr3%`{@bPy?WW+i#!wy($kyR z&SJVzxCPwCXeIDPv(CzD2hQY{t*C|>ktKhKI)6B0f76DRf+Wzs;X`F9q`ZeEg@p95%KB74~- z+&?@2GHp<Z5m)!81M)8uI1i;$83I8z%aculreozsA+>IOGY@0d!LIlVaSzY z!aTwRLKCI;AfE*Dg(=qc21GbytmLT=)aUs;JY@zGce2YQiQ1|EiC)JthDY#QOTb)_ z4>Rn1sD5UUdAs;HNPeS#FiJv{kA#Y(bMW;$SDx9aq&c95vHq`3AUjyHj5i4+8%(;C zQ~ihy=;*>qXibQ*%I^O%zTpg{{h!2!_$TOj+;u>Kc?;+SZ8m+kv}eNn@geYqyZBJu zY=)SYw>|@~2`q`|XHs7fTM09G$VETnq&lH>=*`x1n{`z6Zaum12Wh+yABWoR>UbIo zO?!L&QG3k(b52SW)t$mK^tU~~#Xc%l7kz4%B-P2qUY(o+Q(v(;U5NU;_(E6c2M>@dXRKyph#ZeR0yRT$+aY=n z?|H8kj8A!2Jro&WwwzW(@XGjpNF_uNpM2nWkXOzFpwd)p0AE&|R4te@a5Va#U#{3= zZ3iehI~FrdD+ArHIqsr6oU5kt>qrL4<{f~oci_7Jw{fmXY6X@RJ>@-N@WQW2e8N9n zb~@1w+tWPzxEMV(@Q(yNmA?n&5?|3sz!-)ewtSX@z*E4)~1xnWr z!5?tW{yhH@c=HbG2M0kFMR*0-0A>YSt!SrUBGeSPCheukF!uX6 z$c_)3Y0w4WnOJS`51B{^d8uS?T>CWc+CWeWr9ggmOuP>!EK>bn=yO1^78dvUdwPlq zVJO##-+(>YG5tF-VhMKxYUtQv9zmBI=(-6Pp7lK#P*tU6ITkS735b(qVI?;7=z*py zI$giKv4L`uGO}F;M3+|0W(*)<8)bAW?2+2i9cjl6%UW;e8K<6-|8UuKUMY>&BhPtw zuuw;tdZA@(1{BhVr{-HD%oDWm@a80ho>dV8g0=Vt-tH~SIU1vy$4~m-dSkx~2vX_>z|bhd;-SK8s8)J8BHq`gbLszDcV8D3=5o5Xp zwB%-EsNXYGkWhf(;R!&r-8I6XwwG|KEq)t|Nu30-bjvrC(qAw&gk<46sfaK~SZH zc}dB&=S2qh2NaFi?xF6>wJ>Zo9$xpZN!CYU^1nvKJQY*VEti;c_(BxSh6!;St$U6;8#dkf7vUPQ-#mRqA^a1NX>eEpj+++!^S2*e)!(|oNf zS)oj%@G!AwX9$jkwpEN%*$t3E$M58{_yGX5Oii!@|T9Qhq? z$Z$%6Yv6^;l=^NF9B_AE9YMXmw5VSd>f^5>HJlqRr|0y@Qv5~8dvU=ibYJV2yJx{)#jX0gxcaLm2Qz1{05e}7l&=;k& zecGNkIIDpFPbb=Hm5a6wzFAs#cR>)lr~C;@eKNN}woB~=7qAMD=mh2)nvM+|%8$5`YJT{qr%AN;pBfKmbJN5V0zC zj4Z~3O>vR8zn|ga_Hme(Mbw;uKGwY47(5~{o-da(`lhy;XQEFrCzm|gRn|mvmUg+W z5#gf`+>NaGz!)kX3+#*Y!;bGj-pUE8t1@r`r$`Evq?(aUS4y8tz^mG;tq zBiHe}lU;brth&RD&hjmn(P-1X=^BzDarvYgq5pQ*4KB;JS*2j0ODE$^S>t&4-Ws33 z7GXGq5fp+abh8Ye8!5j0Q9OuN3_={3t247u%+j#mXiFxAu+p!EAj5ta{*I1vzw_)^ zEjlBqXPu)(+zM+^+2U>dv5akBN`!~$vrrz(piz#@TOH=8U%BlSqHd4iLO!FyBeve; zHouK}RAn0|oR`@*tWqJiwKL6zp0hU!+J7ssAqCO5RywninY#WChyjH?-UL0|7YTnk z?8f*bZuJ^xKhVz%DLpy9E@>=z)mL9UHeZgLHa`afmpTu_eyqWR#b zKf9wl^g4N|lEQzraWC*`?@cXlIKEV?UF_qq&Xo$6I?403LA&)QhMuIrc~5VYRD9@f%8LoVuf94JNrd%5sp(f zFSIT(zRG40j~ZDqo;qGy==@?2Ae^FZ>ir0Bf`(N-5MhJzQnG`&`=nnHw+_W&^(O!} z=HZ|zVE*m`Eu1t1GZEf^eIpk==zO3&>$`fgqU~O3^x4U!fR#3t`R?+rVPU9V9CPXO z%@$sEq8tTNcYXA3uHY;kj_>vV(U_~mIV-$M3OS8Hyjy-D_yC@LHo8HL3=k{Gzth<+ z@d_PSCoDKvykdsqghmZ&m~w_+Ktk%>S1~^s;Ir=o>VS%ELVO}RQR6i+fXs6oJmceT65j^}|$ zb}wVPs|k*7&RCZ#g@h2Bj;D6m4+u>P<<%g_eZe$9FNm03!9#*6e+(iM6e^_#tO-Qy zrYc=L;j-IJ1b#hWd3SnyV1$gz5@N3W$Zk19&K7(;Ee{e_CHWr!qqx8g@ zyzHE1SK&trkQeB7@!vL89)pxn_TK)UlvuuI({&W{lNKz<>4u_qSutYF%J>%}9;n(@ zg=3Te+w0eD6I#N6>&#cc*JWfq>Q1$lfQ2QLvvb$KVz(xegd6cvdwE^lG$L9;zY&-N z7ol{!02x9JEJ9$$me8c?g&eqyinaE|wGuKY`wS#=P8=r73V-&Lb=#kfqO4Q73q;X~Rq_o5$Wf}f6N?->Up3bk! z^%b}elB?#vIbPt-Zd zkDrFW@K@%wpAXFkaN*I*&`WHGteT_q$>u4fXkDn^{H3v=Hfqazf1<#$oP5Lo9?fe# zb8So{jiNvgn&jWszX3DMpM(v$v7fxHUZnJf549V_Y93 z_t$4!)9_?YspnYHC-hHHSIIPhxffFk5lzXA zO(Sxd3-O>~;0Q!*7$pA|L`wc(HUqQbMg#z&$zOdSa4`7yT2))`hrJP(M*hRLJy-j? zsF4?g%wJboQONZ?djO$Aej9LEw@r3a%?XN+njlac%YAtwrjcf+$N2cRP=;A}#iGBp z`JwLPIwI$F*OgRc*gHqkWgBzP-x|-!lAh#vPR-zT3^JaA*a`H1g`u|`)$NhjsZ*R7 z&IDUYNFt12h3h8F&e_UW&N&7Uh>=7LNIs2G979Pkwb4FdIHt!&OTDq{)1H2Og-czv zIr2@1sfDQeT3xk?x9{}7Ro;y=N-v<>QY+xda3OpU{C02p_)2;#MQHO`R z_QR~DO=H#4d1v#7Nie>m&@BV%G!INR`tOn8wTMRh?cebBP0xgf+&KJN} zY_!%3z9J=(+BkS?$vCKGwL~Dm>LE@rjldAs8RD?_qqjz7WLmiljvN zRW(nHijOuf+*d*Db+1wq@Wdq}=tK8_ZN0v#g!aZ`PWe^c&j_>K`r0LylsVtWN>t1bCip|HL_=}q?T6! zqbF0Q3#JN+VcYms?4D|GpAag$Y_(?k8--Wv1o670K{F~q>+$%`AsTy5))){lj>kSq{|sG6=*vTADGD7$RA?S*dixp#K4D@O07PEH$O+AO(%aA!oqRY6I9lcn`nLTOlC*_}2|Js$>7}CNl6B7P)F079QvMpEn z+#fu14}SZ=`c_RvY@S}b-J|Forom5)O2$oulcAFdlf3ZMIUguPP6?B+n7)!tAR!l2 z2c2r=32yYOIt9&Yg~i&4jgGO%!|prfFQ-P9HX&|{0a@?`ndyu#hMa&&(og<#mLv`6 z-0`YdlX5DCIFh*3MA%{4Hbgk->90X2fv>zz^87;ASGGM`JCFg6Xn23b90xB!oX}tY zZhg#lsk`&5{O20uX#?5}Z)`{2S{7EnekW+}9%AGx5hND3_uMUJ*XWD0)oe(+8lh5S zuPwn7o?<(E3K^HG#fxzozLB=jn&feC-1od+(zlw?_9vkzNG8Kr|bCTHhWHn z6!~F0rOM=`9Jd>+dARhQh+u{viW@bcZ9MgIyF4R*TX7-5HF<=n&e}P zfLg_>+?(B=2w{?>7Br8?2)g3R3|#j2Vy@u)M|$X#>(2Q@a|A^O0PK9uGjoQ{glAea z!j~MXf=0#)i<@ny>!Yqh|9e7Wy*mh<9=g$EomMEoG!cS|>mjb{z|RhJ97s9qbl;QUUsPH7$p4n$A1cYW(oaqHrF6GiKHtr8uAVsRZ!tC zUkz$L18cOTt_{P|MkINW7qt6Se5Fp<3pTr57xYkRBTp*@PnP+b6RMr7aX^b12-6pV zLfbjHXd5?eQhvI}mgTV!(0PJPi7hUAlwmZ5$DCKEZH$zv3Xfai8LI^&Gvg>sC9+cp zn3}Z16xvGa$+M7g8{kZk#nbmN`SMoB`cv=$EodY) zdnU#4W@{$RBk`4vRdo-rgbWWd^q8x^R84!~b-&S{Ld?E`P(O}%!!EE%Oqt?ry8bIu z&h`rd>5`&VplTz|N+cht2v{wBYYqt4oX18`EHR^UA_ED+0x$%V#wa7(X>S0C2P`nL zo6j|b!>QVZxQn=}->Ph|bE*rHbLmlS;*ZNU2M*KFTxD-J6x1?bI^K+GRo9PoFbapw z1`eow&7W71Z;4=|rgmBxXYu7#)}62!cSY~9DJtZn@_0HYaDw~chnNK23Ki%Ifk1+S zFwho>u&vC8xcJ6A;NV1N89Yw<(ZWOY!McT+7sJN(*f9MJ8j7p?1BbO)a#pn@U69*x zK6KpNJ&&FsiGV~d4j~XMB`MPY>QXoZR82G2#)p~i{Sbievwjt^+CiSFntMcsO7*?w zf6M*jX41j-fwEjFMSDeLr5f|MZRiy?-eR1f;1BuPQNgV;-J*$h>^5T_v>0YOsEz4v0oW`E7~s6FMzl!EPcKG($T*Lp1mvX{uN3+|w_xkm`6d}x|E4;pslJ>WYb z*I9wfna(jrBzQWor0aO;pMgjKmxamQUX*@6?;-C4%Ilg3KyqTphKifW zL~id(MfbdwnYAqJyKXu}!AL1Huz1OWF8=#W4*e4!@_5uJVz0?uad%O z*-knNv;paMi%lCdh$=$J*YRs!5+PYwQJGPUEjosJp$Yo6=X6!6Yr+uhA?e%=?ADm& zZhvRcNzY4Mnug#R=@f-r)4(Tyv?-3wth?Z`;V0Eh^35NOeL*$E2M}=MIpqs<$I!x@xWDi~J~pO54{V&O zf4AY^*ovo8-FAXcYnj#E8{ThvHVz;T902PQKvl1*(dL7F%OCVTZFgylP_1fb95*|- z_S@DpULju(x9w;va)V4*3*)*C7kP%E(z(I8&p7QtHB(;!_$H|dNGOP5^9w~XNf+uN zOs}-=^YeBb+iduRUbkPICx1;kQ8)168kF%d9FQnw6LF}YJx^%M7Y4WJdU3-Ytp701 z+Lo|RzyBq@FZq}PjGw99P0zoZB2!1kWT##dg)4sWYSb*MP}SN01(J z%=rj@@)6}?uqZBY6-?^Nr?m=^$0OiWHJL{Ce;#{<6w~@{uN02|FhmItf}xAJ{O=i) z`=8U*s#H=%v`O_GL{mOqVU9RMF#df_Lxv36?cZ15_MMQh{-1un#FhwQ^T+7+t zJb;|{Qe&czC1Pn0hrxf;#NMhmKH7L?h6>w1GjX2!;h~~&k3$@KqC#y@r+uh2T`c-Shyg?0HF>^eU+^>1{W*?FPl{)>Cfk}TDnwv$ z>%e{Aev5drq1ts){K)vm){%>Zhy6}}Ue9yP7xFBY=;(`KX2a>NTpK4BTFlC^ZY1q7 zJ2++ewn@)%{MXBcPzr7We9hSAAnZHHvYIhhZ;i~HN!rs|_cyCU{yKm@!h7PlUHDXF z$$|R$udbsAgdf!%QL#1yqIXa#=3c_G$6I*FKbDmzFaK)O7EV05CnbK}OLL(#8Fmriy$O|(Db!=deFmtbw6~;eDpII7SRdrm#=QB{+pkpeUR_$pu=Ht7- z(z*R`$TZt`OVdZQXGHVAUSmd(R)BXGO3FMQdxIR1G&N2~DDf_s1}yT#4*t38Q%!HW zL8Euu2Pf3C5xcit)i4VEH8fJcWnmzLIJ)Cp#lbEKlM4ulXh zqQq9pn+h6!<T_3qlQ-j#vSi-P}W97U)3Nj|ss$C?s>#a_|G z^rZt`QC!~n)b6(0B$T401kDC?;93>JV^YT_k?GuXv0e1p;Zw1kiGPXEi4{1!l`Ggn zje`XIj0mgXnsGW(?5S$?YCw9cz7|wEF`2m_PEgK7odDVG6XvO&nm%<$D@}2xwxH}x z7SZWR$oapS(n4f)2VfjRF6k@RS_I?lfT@#XeX7&T_-^Z`D{7v=H#JPyKF|WorE3G+ z=r9C#ePQ9hA>W^Y@wWsAjaC|$!608ks_a>CS)vniD#*bks~%y2$FP)HGJCtC%K6Iz ziQHBx{9i8aa+$~R`L_|rj0D`G{TaMA8SrYq0rsz3qSyzSH-I0Blu(qcZ7S^mzi|>3 zQgeD-9EJui9J8CHum0{-=hfL|znyM&`#v4VYcS2~CrEua&2VLsf*}lUF;=FnUxgqN zSBi@wh!mb(m7QGwa1Ie5-y%tbv^4!zX% zmP(A*CdTR`$=+mdo&QwheZ;V=(Zn9SC{9+SeO)mB>z|TVYcyZGF9RDnUd-KgL?Sg{>)pCP?(a|nICPCc zv;=o%S8idye<*Bjjz6u3Vha&3$4NfwSl_VY_#Q7x+LJ&V>+hXB5XiOjVv zM~aHwXDEo%Gv&6TQ;@BDcbaM!lJX9GdmCp3tKGzaxr#`|kbI`Vm39^KC9L-oJ#^e8 z^>*Qb|gXCYIU{tEfGYal(NGmmIfOnHX7If{R?M-H>#Z}9~ zpqDQQ8IUzf)0v@iju-Hf)j-q#`qkYAGZ%Jq_B;gy@zM*B#my3CHdn=Hm+wGWoR?{P z_P@eQ#1F7*d*?gA1}d|j0+xzjd6ZeCe)Jk>2$2io-}97HJ69b*`7mh7m$Pm_lMgbh znG~k~sssB*C|)I;hvOH&d?KeAck~PJ`{e|6pL*ma-f)g7oRK60OSLpMitX_iyjDPD zM-ZhdPjEniyNxUriltpo`7N)y#CjQ*o?%kia&PaHJ?5NTS@-4mN5HTAI*?lvxm}SI zL{;=skIfk1h+Fx@!oh|Wgxd87DBS)xEVuxfVo#GV6$qW3FggAf zzS#Q_O_D`7*0IhaoS^>kiD9J2*{7UYmvO{HqwV~**n$}&G-NCD6izADLl_#{dDC6v z$qr0=1^{GolZLO(kMXd^!Xam_S%t#|d^AgwhWvG+rr@QwJ~$~y)7KrZWzqnFYDUom zL)k%bKHNDVBln{%D|1PJHM>>tiuD*<-~uM#dx@H(V~$<_=chVS2Fj&|?L8h%+Xku| zMCjf&siPw0=Mlc#)8{*3LfoswFv?0eY(6k+jbn53lzQRFtN?LCaU6g{t~m^xrp;gEYI=kcKV>IPiD9yIAvl+)~a>V(!3X@Gvfm(FKE_}HNYx`gCfG6eQry4*Z z{*NZvxrzWy&kIFK#o$5`i|W*HYulPL5aYJQ>=CD?##(pBBF)wXmd2|8mfcrqgCJHC zKL{!bSbUP}Amvlc{&%75BrEy$b}D}bSByjspDjqpDEvv=^C|CjvXWm2b$HISdQx*RAuCvAQa2QX4-LupXQ+Af49M{G%D!H3Ge1nn2NZf!eH2)pzb!xV)`MijFO zPD{3vq&|J%$mC@ej2x$aG(Mhjy%NUo5F#{j+2Eqp8#^2R_`>_$_cCUS6BZNS=vVJvQVf>G!Wa2x0u5p6_Ch3}Auh&cWD^U{#%2s2lJpgT zcs-fo>sb|<11u^DWiexm;*2JXoMJ)tvWs#91uW2lN+b55w^l>yV48&pgCe5CSJ8F{ z_SO@kg_m|AM?rH(LC@%VIzc;?d(FMy^OGQWEE$Z7ub=F>bZ1a?~?Vo{n z$C`iSVsgUbW#j1APR|)xDc5rULl7M(mnSBu1AxMtRvM!ou+-z{Y0pxyoU=Eg!}8A6 z3p5^u=SMt@=$`?rF;m^a_vdS_&w zl2={Y}XBCEvCg*_ZE zrXQ=Go8b_Hqk3D{fPRgVORj++h?v5cqQ+ayubhPdNSWAaj9 zf>4Z8WK2t)Etqu>4ba5-7*)5q0yNN4>vBqi3prf+&+%_E4Q1>LNGdp=V_t6K>swE! zOGv`#h+1bdr*ovmr#Up1y-z3lYDv1XGV!mkN2<(4;5j^j{7Zmb(@j)3-Azw|qCX}; zl}`YiN~WtcuPD&%ab#>Sswc*BQd5xwHBx4oIS=v1$|&Q-o7s-b^Etcs*QGL*r1m%hHrJ}qUtKH!?4QQsJr}& zUD5{OAFyc|jiI_v3@&z|T8p;)=!j7_0qi9+7%_>iKy4X(n}cTD|Ggf^-X6up_N=Q` zYMVOgl*xCZ%&D7ImNMYbUMzve8w%Ec9sttA8Q6QFJYDYmb#o4__X`5B4UFY4QD%}* z(xo1p2&8jv!p!j1VYJ1<GPFA2C2N8%O!tDL{bVzm+oE~% ztuAX*283&A(+IuSiMoCr5zmr@8ZX$tP+#__nFYq-R>^5JuCzag( zY06edQ8SWR!Le*{vYkL$T^iEMiwdETJBAKKh&0^TV| z+*lx!q{BkWyvqOspw1-JzFNua9{|~9X`jJ!RXnQ{e<|9bXW~3hk6<>C)u}mEL}&Gb zU!DB?#DKVG&IOcz^R3Z~-T-yvKRIVBTk>68Ef2ZUCiz)NR55g11NHnSVdTA-@wj6g zJ!J>2(STmgEyGqVKSXdClyoLM+3M{?$(1v+1_v-ozLB9g@cJ`2pxG}u-<3@i*_gHu z*&RaB;%;+HEie3@SWh}+8UZvo1=||>(|z}AQ1CDnaYiOu3tYC^AeQRjb*;rjkc#V? zoGN4ur<4gw))oO}J}zX5|J2?2TkRG&%u3T3hpq!g{T{4Qj(VpZi}cfj=>veVPU)4_ zEXJ0B255M{Q`-tLh`o#CqOV9cxHAsv8M^>`NBPxMI4iW+RiF5h*^PQivV$rWbCIU} z8d_p~b*k`+ct#l+Exj)GDJ}}$La{W-!!e~cW#4VoRpI!hq5rJ8D*uf%YyrR9QA%{E zX(_P=^sAt}V^52gAET&L>7MX)iYewEj4J;Om!_H?n{}oAU8$_8B%K#DaQN=#2sbn;znHAFgG0j>7SU7PS%=2MET@z=MeNd5bc>#))It^b=r~%p!MUXY1wQuDM!}}kUQnwAY z(a1+|7_ulrJ_2cnN5WS*q0F@n7kgkJTVo^2B_^NNkHpfS-%b}OnNQx1*IbyKjF8;% znL)6>MXblMzQ~h1Bd#5k+rmWgq7NrD%5zMtPSOf6mJGZ}Wi11?&h;H+=|K;&nsk`{ zXqqcFwasJ-v)q5i0oPg!zUc!)&h(;!Z4L9!3hJI>UJ06??`;HMWNj`VL!dGL41P!~ z!QAMb?yZ(=rRne`o;He|o1RViInFjbS4I$wreHUpeO?d4=6^E2tO-KE{ngb1uU`7U z6|s$^Gr64}Y`V32RdLEAPh?v)AjlWX$T*bE9R@PH5fM96r$N7Z3Mq8akDIAc-2+gf z1%>)xmz`{bE|9twmeVW(J8=0+!`&Whn%?j6hQo1OKB~loulhW5}*vRzK*E< z4CBoV1rkdAu^*Iox1ksXdm<$s%M+(_@sGR@Ishp2@Xx2rfaY>4!O$Dz1XhAE0uXjA ziL2-+Vf|0QaVXZZ)`|R_H!uIKsPm7LUo+Tf$N^TbGYi@s_mg^IR)hd0_?g4LP?)t8 zR(h9d#YIL&@EK}IiR8<@%iCf%Su5~XLO0(U(->X_)v7oaqS4NZT8NjPNMlI_w~D8mlLCV&HQNSA^U8w zt{>rKy^{Af#k~C=X=E!c4FNM-XnVQDi}fglqfqnEd3&QT+HU@WNha{&mA z?BPs$*L0vo%f`U4`}4OQyLf7@S_2EPj+_Xl#73VNr|u~>$bm6omfy|zw`EE8bq^jp z5jH#R1!5KhWj}o=^iMvAoRQB*=BRwk+YC*KLkgt}{WqX(KOg)^al~qjNRL zZ%s7|8WlqOUby_F2Ib61&2SXsYh?FJ6*_W6Krm$uAKccp7~n{=(sV;D!do_-oEGHs ze5Qi~N^}Xjd(vLW8ij{U@;#s+S+1$zxX_^c-F{#xNIKY0mxUzE4T@?EA20w7OE3Ui#A7@L<7FaQ<_B^IAE=YIc4?Vo19owOsd0u9Fn$<48IcGGu z4rgz5jT|x7KP3kL+ctBa$9lLA|Na)oBoSfI;t7BT`DjSdMH+Jzmq_r?`R$d0`A^lb z_c&6@iYr^4Z{0dXG{m#E=yP)t6{7Drh0(X+u$;{!5UN3g;>c<44O7Izk&{W^ce6W% zhyRE33OMy)iKn#WyQ11d{$w43CRr0W`*#Sdez++NpUHU#Thg%5OzI{aV;(FA?}=FD zhkZNkf@^B7WY#*XJ3B%iD(%WuMY-kC zmd4^_8)DA6t<{cmr)s70_gNh5Lmxa?t69k+w3p3Z2awe;#E3Rr zp1t0>?z2;*X)M~M(vLB56;Iohd}kJAmzVU_R`=!XB~cPD6z$xM`Zf0Xr4|m|D1Fle z!#tbkcZ@5}=JMrAU}jbfNMV~LJQmIH%<}Ohq`3I8mbd(2G}*HD)sXhNMLibHHB11R z3K3zbsbF#uO-!RQr15EmITB5X4J10aZgs5#j!m^UlVyfCdUQBFYP*3!GUM;G5 zWawqcdi71@<#qn@TOK?!$T4?6b9}hYU%8+KknkA4v?Cs0rnIiy#aBm8dD>7I6DErE zX?pZC?It0`Kcw|1#p-DY-7M}nfHYR1L!93~gsLiDAMx+d+_sA{U;^eqa_l@~CeL2j z$N3q~t&ydcalZbQre*D*l<0o^iCtdSnjU=L;L{9I*ZZozo;Ko;!Vr~xW?5g2?X!+S z#E<4IxMEr8{9yMLC->Z!fMNV>$YiJpBDcxQ-N$Csl&XC}pLD_mvtXIK%_q8NoX%W+ zgNg1AxLcYhm|Mq;OyG@%>dvuhIIV449BtDcX~p5KAnM#Sm?f0XaivE6=*P`#vB)mw z?l;UjzUw9bvCz0M1xY24(qtXlwe(aofhsd6YpDdVSawM=rvk7F{B@VeH9~_u`6_t4 zl^j4e4Hn28B0rs^+Pxz$P)Ee-zMvp*((h-93cZ~eJNI{VpE)Kz66|H-k4gnEPjtT` zF@%nFoE0m!Lk$C-xSh95M17UlCSC~Xd{{6)`kG|^i9>#Y!4gNM@o=D!kGso#w-)9> zkF)U6&s!^~!Hy4e5{}iB;TV@e${NIc#lAW6 zPyOz|XuK*Pi+S3LeU6t92x^D@2Z(a5&7)Ku6P!(k-!HYIY!SLA035Fz*g3?zQIpp| zrvGR+j=@At5`+)2BoCYkwmfU5MsC~20{;8Ks2_E};yR-c<1{u;P*0y?%f~q)% z*{a;O9jG_#{q41nJ>{w9Nuukf${|c>7C9Q0eKyjm?zy+C$&?~7^^F8 za!=XO$0CWZFv+6ZfMP6=#UwI|1tWeN7{x<}&Fqj5_{{NW{p%#6@U8#AzXzzjg&_R9Q-yBGVP8W z&M8|7^TS>O7GeU~{J^YuX+6iy=?F9*Yy1w|zy85a;Eot8gZoL#vYu^RuL}{*Y!N+Y zYsTAZ%3cao4x{FnM81~IGO+)0^8;6BCPq#IUiU-$OHb{CE!6|0I4q*A#GQQJxM?|f zHfdpn^vHZ$G8II{(jEX1^Tbaqz|X0baLpLtBwzGYk2wpTO%*)|2ER}$;r=c3vs3Z6 zkLlI)c@6_>%hOsFlyo-5Ff8|*GVONLFjn;m52)h?#vUc=RwS@=H%=_t!ZJBu`Ag;U zPqzu?OP^)O##jvwKszeN3m~f?afWMb=$bjNU(gr5fE-%?@p1t5WkUp; zKmY%3N?HRcL>qeL#r$_n6Wm(7f5X2N#UWN?(DB8 zLYj^|>~!a~?<8o@tUF?nn}3R-*n~a!{xjtgNmDG=%><5d2OooJUm3f%5}Db`z04~O zGhKSw9i0&G8{PD5h#b4Wrwhi(MB7h|5Qhk*^QlE~WUNwRY8}Hc>Oko!ifT{Hrxxo=9bvD}Xy7ZP9dH(@ z;gJ*qGd;Bvp95Vu)`-0d+KzKr?OKLh6ce_KPf7UC#ePat7`|E~4)YJ6Jzn`h6mt=3 zsKSW67Ed4)whmn|ryH@hU4`O~|Hlk;qb_Me62h!_T3@$d+9s9NO8kAy6D}!Nxh&;jJA(gfhH*gCP0y zkzzxmyt7>(uWHZ%VNU~mP^=>3NdFW1iy&NXR4SD~1MEq3Oc-|OS+?3t(tAV>dPp#z zpNU!pPCe)|KBTJt$7RrO*2(dK;BGp7dA^xY!DlicA|LLqdgs36uK>9%L^=9^ei1c! z5h=9E=!v>91U~dbGom5eO(X~_*0nPOQwkdAmJ>AD@H#4SrD&qU9xJ|H6?f-zBW%NC z+uFYUg0E(#D4(8`Kw|!6psXjD#u8yk8{MHJyjWKtAI?cXCPCX&sE^WkX@1!Twh9H< z7+pZ!2{hRrsHchhlP1`f*cR>B#xNs|Iz7EdEwN2wc*bBN!)yzpI5C9tsf*^utP!A1 ztw99BilyaDqfuf8cJ31+2CQ#I`VdWo0O_i#S4cfSgC&tfQTUh{McS)m0HU_&#Nkc6 zB7=^J=Z7!MQS{HNHQ$6n)BSXvTp68@BJ3|w=@FG#(Vb#2ai&CkXU3!fHw^-sv1vfEq7w88E5NaA9yWYixc zSg|{CNS7X*%=Mb?7@VontI9!}u>!XyLT*MvLh?S9eHNx;qa6i!U@1}@<`a2O?C!(h zYTg5C`a4_Y6ND&Z0ll2^Q=DF-LWL1eIm&x__G{J93?qRKORg@C3a4|sl?CLiM8EG< zLn&kQ`ar51`}a+zn(%@(A-{BA8{9z5LtPz1aA20kcI|9%)i@lD>h}8<>8euRr>v<) zp}hVHUtmEBU#IEm(S1Prf)Xa`3rLAs@xw#jA8$8kS7HwkME1*fWu!iJ9Srr|>Y9%a zIEve3YaZen!;x3iisw2ZVDA9Z6;QpmKx#xA#w)|v%|ghd_K6Je?V_N9PMFR`nzbMN z_O&NcT=f_;vP{OaDz8H=Ng&RQkp5*#ZX7HHX%YQwuOr+TgJC!mis&H_L?WA~o^pq{ z3KT%9R`*5gP*q1AF}h6cvGB3nztTt;%8014q!&7S_nuhmCdq3W=CIA9NE=@fE?(vH ztNV&KJD~AQLx5bwQUFJ^oH6IKQ?ZMQ)%GE!9#43(78B~699Poj<$)$QVEH3Ffnm4X zK_SX-^s)<~UR4d-QcOAfM<@%*OmO}F9@GZ{LufFv#7dieXJBD+S8U?IF%Hk@8qw*g z2A<#9w+=Lr`XE~)Rq8#pNjp7JM4f#`=)w{fm6U+Ct`fasX{IDO~AvtzfXk{j7Z7a7*oZ zfI2=uim^(u3%G8J7mHL?5#ZV9U(>OztWJQjA08^4x}O%32Eti1TPh*$i&!EdH6Bo< zK7Kj@Kym+Y%>2x$h8JBj@ulCnpUmNY?*=S~NFt6^@!UZ=(A$Z?@K;r)eus3gcV^U7 zBum}<;q*cQBb8*d0W|{xWno-aE6z~ElaA3Is$f>Lw8>eol?V*xEZ?XQM_Mw?fn#(n zl`sC&Yl+-9)8OJ2_H!XNh{)2c!ZOI{bf0xtbboTs=nmdFUf1FFy__2fJ5%r+&uY`y z{3*mOo4!T;U0sI(#{mmd2gX)!FutT}(2dG9Tjc~1+1@6t7{MEMu%kMA{;EgdT_hPPD7(v{GT+Z7qY}8ec)FsGoK6E zp8tb$jOkhU;~K~wmuX^Oy*D>@f)oS$2ePkCdM}FShiqigj5~)E)ou*oX6Q&xqlrcek`c#;S?i z0J)RonJP=A8V_NSQZdwcJ+GPhxsfHEG_nHQ!gQQL%70CTx86n|oGagN4dmPX($MkX zxMf%kYozklVh@DgQfT#N!UFGnT-={;*VkRtswvPaz>i$Q#%I(X3Iq$=znne&3 z+6D)XMYF%Z-IOGy9*kUg=DfPC!D#h@^Z+PLe+%mS>}t1`^XK?0SIKw*otcN4d$E3T#&tv_TR zR4*@{T`D-cthSHKO^UM3sYzw0CH}`ymmuOP>>*^E@MFuzuC%cf#WlbG((4xt_O*7Q zGl8wR_Zx2~onqwixJ2t+Vfs<5oWRpOev9UVD(O961M%M=dr*>I8c>b6@Q{zg#x<8g z8?*dUpjNjKkFOdcG&h`j>KN4#lFX$wj+N*d*iZ&w9J`ZMAp{p$=~X0rsbI%C0rDi= zH`-eUprSU=913+lG~1|_Zys>ehzzi}GW`m3e7chYE28;+)~;#aX!9A^$e~cG#0>o{ z(&GK9frG<15#%VIOIJ5LfLDZz{cCMhTYE6&oDZG?hvtO1x*X+lHU^|M2M8=6h_iat zp^Xg$6DH|FTCPj?OF4l1lpwbBXA5jzg5V>1K9P#U~^7B^dLzClsIk5Tw^3tR2&j^bWR%}Xo7CN0n ze6uSYE#C;C&AJLO0viLEN|(aOsQ!H~4uX&R(>xcP+W!48Z%xN>tyszBP^JJ2`iZ0H z#sWxhC~0|5>WWd>F(;|$%X?&1Ua}8DAXSO{Dkp0Mtc({6ANo-eg^iUvBi3D)w2jgMi5i^j7KRE<3%oWHK5jiPD? z%TH~}i=Q37?NRgnNnMPCk47BFj(xC|LM(ubb1bg=pT#NPWsJp>EJRtsWQVgwUpYup zJ_e72QnN87*RSAZiUhc=IMqX@MMt)2skJQfR-~?ouF}{*i+|{Cl3KRc#%N`7F6pMP z=GwO)UfP1pNt~%$*x1?ouhF@iNf^huEq-!O&v@lET;N}`RXiQWMIpdIr{8x=g+<3T@{|wkWPj(&~MNgD?xZb-gz$@v-jIfD9Yg#k9?!39Ip47A}WwLkH)O5|F z-_qjOSqzKDFXS3HPAk~5$966ak*}fX#iNf@z)nlHFO?G|d*Wr?3g1m(Th}8%L}yEw z49-vRA;apT=l)!-oUvKsP9rp3)`x@qUv<5JP$c-WX*%Slub8h5x9$!<=^u+jKOzLa z?CR2|hyJeKC#Zd*n?JdhrBcAv*o5paA1n8l%cI;T&j_{y=XciOlK+TG_>DC4j_StgU{5j+PCC)Uyjb)-y zSXXMeQWCAiAJnF2cmt(nuq^j9r6OETG8~UJmJftvhj=4kEUkfm6QOJR==Co&F_W2m zTi3*lT(*6WyVYdG&g`T>Y)#{}^RjBGm_; zXjm3+425bC+JphquYME69}<_Vs~)Dc849Cmd#GTxaAqO2by1TSM01vS?|T-E_8zKi zDh&wc-OUcT9Tlnn#^-NWo>mWSd{wO(I4*B}$+a@DO;-#J{ z?PTx=g+vs$7|hOG>XNdxn4XJ899T` ziR%~|vqozU7~Qp~g)*a}NI-@Q-s0Bv#y@U`(;>KzK%ru|+SkJv~C$6s$YL zw)IB#4GNj*XUVpW?uC1Ag0xvCXV?937a9_@F%x&Ka4{6-+<(N@Ugp!e|mf85G!$LLe4Jmo0^qlX*jR8D|GaCE*^Ilb>#vj#oR zNpumEM&(X%|9sXcRP8dpJFJ z#<|#GvwWGYiAb~qIi^(L8KdNzzB~|lf8K|wGxO=r00Qptt+oAV&2gK^Ic=bW9hMpUMq@>(GbyyhRNQRj|sOS8qwrWl_Is;trL-_wi zlE#cn?r|k@L|R)!WqMiB%}tiqqbst9;9M(^8K%~RGAVREDG@7N4=3icf;dVKe!|?U zc`X+YLv#F`^)G3Qk^Aluo)ZQXXo_rwN8YuDZFrw&9z}c5&QQ6}fc_B#Jq&7!sbFb; z{_B%G2S?wJ8zs~vm0{~^5!+#G*T@^Vmo31RN&P9`MCLM!8ES?cChY-T2$nIBK ze7rwWKo&JB7d4BUW-k&b0MC5qH8=@}^r{Bh|xLS2A}few|TP!-k3jN|wxG zOktULV^CJb%+kyq;wIUZvqsr0ym2GZ|@ z%xVw`7?;da{`CK=BMzv7xWn2vu<4< z0~ixrDqBNH%`hb!C%w0~=$j8jVrD@?d!Qr|N)6YyCLOUX7zwM^KGL}HEt=em(+Gq* zNblYm^m5EY&wJ!HJ<;ws{dWy?9C^(PJ=Jixe@Ey?+<2jEGJ7;~Ctz?1PG*sLLdvph z#j-d56|xS_cA7*jO^zE|PqZB-2O-6y)KA0U5Y>ElrAp9{uH^5%V6&)ZcV3b>+6rvdZn zR{Jop0xdza#i@9iyVZHZ(MKo6O3jk_8YL~3R^xiYw}}spj#=)+#$y4!%p*9fWL+aS zAnnzB6N!;l-@>2xsB5lIF5Z%6{x3ua%uZb3b4y>`-PBY8ZKCnmWod(KEYj| zzFK`A=6gt8Zzz%rj#S`4xF;Ci9m(Pd-j8TFaurJ(;0Sm`QQ>nH45lplPYW&p_g^S^ zR{r?`bp55t*-*`|p zU*(n2?tS`bpeTn9zlUnBhJLn6GG2&N(3)gt^D-8QuE*O;2d;1BXx}kOcWkq)VaWH^ z$TH^jAa|eWAO=6fi_)ZbkvujYiVj2npZC4ryP$!wuk8XZuKw=+oCYFL*0dmK^@Pq7 ziQmtmTI3Xwe*#TrxZW(9W2NgC{olg`N;_$1gzju2AEdkGBGkNxBKW#cc3Dw=CU$uQ zBQWgAvH2(^pk=5B#6SV9DclW;&`208o7`%VI$FD*dWj`tilGAjqvt(1q_^$m*STvC z0SYiCcsKeS6$ttIrUi~|axQ56o!~W=^`^MG1=$KyG>Ls3T0%U>Y%@AH=>=nwLWOaI zhsk1K7sKs5Gjqrads=b^?)YW_r)>PL@+yYVw;~h7sub9hGvvoaAfD^Qh$Tci`lItf zLR|87tNk|1Wib|ttZYysSWsrs*n<2ssF8CR_*eyoX1&szA7d3Qw0)nJ;lfcoNZt#i zmlH9+UQAU*iOR#+pU|=kEtaiyLj?{G=%9Oh_H@Yi*=oNB41>&L8|XkKvCR;sGMcgE z-LV0dm{%D}lTrvvR|(kyZKAD&x8OKyo#s_H_6T)gwyJ0x%}?A2|MZN9 zbH9ep{s4@WHV~NkC=0EL&Pf|&;)8x_ zza2F1%UpPzHyI5n!?iem0^}!88@zAv4HUjQP&xAD{WMmp8&YTy`*Rg`8lxnoOq#K= zb?&dYnSjW7I=d2Olai-FKi$&G&DnHQ)Iv9e zBhFqjCGQ@&9ULwDiWPy75<_0JRIYy1A4RzR)0!7@6(lLm4#GIi^!a0WsKYR0orm<} z30OP1I_cf}CPFdLH^veIF=St7K2?_GEH;&CD8lOg-=U)%Sq}fBN4QFkG!B1o*N|)A zwnA?qd$={K{OwKv3r95MJi)8JKg?-|X3V>J4;E@TouQX1(hG+c?wX9k`gL|pQnM$D zwSdm1c4a5OuD^pTGu;@T59hsD4;*tqTiH^e{Jb<}Ce{>Rez{UQpQ@q+2Nql3fd2hB zElJZuT}tcYB1{k`lz873sUq~J3X$1VjG#)gmA)?Sra!m1HKxmmzJl~M-29);fRI$* z$iK^`zNwlDKM36iLTuXF<*z(M%jZKJ=ftoFQ*LtM&duTaGUFcBdf48O4bCx>wed5r z%)20eoBQIq4d8Cb)f>OxF0B}Rx!P8TB2wrB3vP+utVftf_BJczE>9D1vJ&cf2-wrTr*axL~BIli+tI@1iC+59Y_;K!jW|wr(?_6bshR z++op06}+>6nVc@CT;Dzllt zO#pPUxnz5eS(H`o{P;vqsh|JU9c zjbNJSJ8a&RkAnxPhEV1Cj}rd_TeiGkkH*uGr%0XdNUZfG53u?b&|IQ`R54IIAs>~^ z{&=b6Q!G=E2f~97$<^`kZxxwjAU4wI zh1Z+09IDK*DNFi;+qx=Ih#E5c0HBn)p;h%)8STv2Pi>+P&(`1YyV}3$5Ytc&+ps7&zsTRNo>~cee7Ve*n;u~L3MiLv#X=u$ z+_p0jzGjljJ+C_Hx)d5F5f}!#z4k!|H6jW2r`$_%-V$*?=k)e0GB*~8CN$?g7`1ru zCe*(X#EasNP3M&L=YnWnO~McO%1eY91L7cN<%R+IpB;g$5o^+xbTv`Q2)Bxw71B%2 zxy&q)Hxv-d?JquOTKHnseXTzA#Wo`bkt|!aCOpH)Iwh01HhTt%LTgZeY)R+Q01MKa zD!|bfAF?nD1;g<4?!(*L>mBcQqS;O`VSs>Pm{DI1_yF@pDJPH!PFkw2DprhZ=r-~z4t~J>-_q6N-2LC}1&SVPN>W0e;Zs}5ai*OMW z(nOr_3lPG@D-SvK_y*|r#{pV;8=gdXeP|o`Ni1_rSRiyeE>koSH;ze#()9BT<-dquh(DXHHKeeLh8sZr76u-VlI?BTTCY)RN zce()!WYQr+lkAvFOy}1V(Ep)DV9Al~Asg1rab(SCsP4WLE0mN*I1g^1jFNMx{Sbb; z@ktY+@cW^C75wj=breXcjS5B5(YZG|wM7BOoQa0or{Y zl;E^j;{#*UozOvk&tcAagbR+@g@nnh2?1!f(&ANc9O+!^%iI~0XZm_R*CI)$n3^=n zv(u;9IM&hntjP0LjPk*Zd;x`iPg)EoHSXl|`rQeex=PlTmX$t4jTXNAOUzP|upa5- z`eQn0JQQHAt=x62*u)4plPVSwo36j;5_hC`={wAb6;B1=ir_*-hs zb>{xP6C{vpU2)n*!KQW&Obl&Mc-QFgNencA?!XxfSzO~lM2hP?{6vl>Er`Xt%!r#X zyk23dn0u2`7}5rsl0U`PhX6t}>FfRUnHfo|>&IE=g!SnnY$9{gRp-%v*k#kvYOFca zk>gn`?;3|+#SkQsWwU*bvH>pfSmrb=cmTCo`2iS)D#ZIwdT zC1OX2S_v_{t#2~FLE1#)wmtkICj!nzllaTchK(8Sq7HOeu;0IWr>ktQB)6{NG{WxO zF_XX8s1dCA;Q2Hjq&$ple{Di^b?BqMrf=mY-VQ=vf|9}$2f7)pe|8t%X$d3pOTx&H zD*8q*uK=&cv1@gdQMgtKFj1A&5e)b4p{m%l-9P#@pM9QI2)0>HSJ)#Pl`Tp$!j-ng z+%zL-wSl?_)9Xr`px$*_m|m(hjS>9;6s#TmfIUZ**uTaL{(aXYMH@$**T#VY)c&A{ za!#1;?}9x>GGWPt8nr8fH+aA4%ynf{6E|mdlISHhuhzuDkWEST6u-D`;EXarqV6or zNa%Lu+K;un&M`^CKdyRpki(e>CXirs}{z_^%ntCa~FWxawUnz_a`!;NcQ6{uxl0JwM_Cn=7wf#%J^31zJ!>`Y; z$KWuGwdEHQpxxg<&>U1c2K-FvPb`Cx0;oUv{@mc&@DnuGkZHfXZ1VD$+Z#-QKM9+KCf-Z~{RQt`ys&`&~ds!a`&|{@t zM@vM@9r#luw3zaV^g>@`MizDZxrHn6FY@F0<60TbS({+dtWpPWNHytKY}1fQyJ#Jm zXgcq0?hF}CYTaLVl&;XgiQgdNsF&f1P; zHVQIKcDC4!UFs|~Ghv!n@Q{!6>0LD9gtJyG`=w=e@nIs9TluDUp27O9wFC7UV_6sT z340bfdc`j9t?}q$f8aXr<>CDj1~Dw*-+DQLalLYr6?B8<@oz>-gZO@0tBtxIQ-e!* zz2=p^%4v^5r)YknHbt@*{nBD);f?0*Fi*^uzkEXK6V%*5Hr>25DfL3lq$!iYed9D_ zx7ZQi?|FQB@O7pW>~eR?<{^MSEn?}IZznqWvAMezEx5Aj$#+w$BO$_b?LL%+0M=c) znI!m{W?N65fB*${%{}*ASq6W+Yw4)eO3=)YiJPmj znZKdU^>pHY;=uEXF(tNdG-Ju^XM;QA4$sGt+-;E}08TeD@9o*sR`8}SxGFYfq|AOE zqVZgeaB?ySR~Mh^{{dO)x$O0A1a*VGEcSiJP9?hg!|#^fEA9!3Oi&eSFhgk8Ru~BZ zXdztOwBblayUpspx0>slu7xR6{A~mq?1CMlse;>St6S!~F~Bh^y0-v6K*7Jus0kI0 zlS9>i&yYG*(RXrcdM=KE%b#R|n6jipZGQCvVpW93-^lUsGNe3`;H6{ga2Pa{5vx>( z&P)uR_+e|mjBL&F>sUD$11o{B^$s;CiH*?-)VL3U+G`Ljs^`>|m?HpogXv?XzR_`d zt!BK$*9w}XdM);mj>4ZOUOZeCRy)xoDH#ham}Qwfj>Fe^HDT2#&#R!Q9M{}+Lv7A> zYO@(zUiy{(F3$4bD9MmBMh9cmCyUz0C5eYS#enTJJW1ajIGY^B+F8zr=gOu8e7f>s zW=aW%wBQxNi%qSQ%K=tYR_gn|Wq++MxOL9hLt3W#Rpo?Gw=%%(K3FqU zQ8Q80bw3Lczn)naauScsOUlIIMR?d+kNvJ4V}diVJ~I(x5ks}X?eHL_`&&DhF=>vl z%4V!bjmx$)c7Hm1;pg=dlTkl2LHVtUp~U6;t$oRjSn2s<{i$MOjcYjh%FQIF76-gQ zivdkA#NBw3RNU7*Orl3IW08@(R>y9xm>Wp+JY#$#f`dpZr0_`Rf;w_UIX~lZ?Txo_ z0AUbD?wwH(Rh0l>?>*5>;%!tY%hiH3+%iv!I9u$qZbG)6)h*PX-ZMiwrQS-UIa6#o z>Vy_nE4s#34Zvak#hJ!l4vx&DNhH7RCH@25sUXWpU~5)Q18ZejJAjH+tFh?aN*kK6J_t?XrW-0YL$*5ydI;!=@^ug` z4dohRxJLsGgH`b*KWdhHKZQ@?95;tT>yYiJL+>W&OR*a5PV}4}FPApi9ID;{Thg{V z&$TK=xvI?4{z~eg4_mCFsjIn_TWsAyfL3DLV_V{)j&%WQX=S$ev_&+iplajsup_iL zftyt38|Nso&TZvjr~1#enY-d;#)JeGh6#tQ$Sch8D0}hjr$}Ao8u{D;v>&L#J2823 z*R|<9YVYymY^#{4?Vz(^w##m>tx|AOwgL(02cGV8#XdX#2wvnhMptvO%S(TJ44$Pa zJcGkJ$M{gxSVg4W1B7T!_Pq?LgPKLZ^hKc4ST_BPa{nw&`KfKuMgcF1}33CgjSE{SGP;kZaMJvzeVJnrj$H^Xa)(B ziVHPNs_bJ5A96i(9<=+G5HQ>_K%f8WiuF?g$Ks1JwyByth6dJ94P8XTD1C}Ta=mJEqa(qJ23 z)th!AvAKIZ^VIir-9hS5n|fc-yE}z7)VSJ~`H}>C?8OTz9gw4VyS5wH!u^=QaJ073 zq77S)<@t{cvU*S+Ef%{w#0`>Oj41)$&h{|n+3;!%=}eTo*9`Fn+2Q12c&H>ayp7P| zg?7=`7~;1k2GII;IwHKQTH>W*ozoCN5YV&22eM7ET8J0%9|i3VO2;)CYC_(JaXp@# zKD1uvk2S}Co7Q!50hxr=my{SH6Q1o<;kKSLV}LvI9*-4+nsw9Ea7vCI^su2vJ)!m- z{XI$Vl<A_3P(kovx|gGsu`( zjJ-na_S3Hj3CKxbr*SrtN2gDT*G|;yi=)Jeh(^*<%`R96_hma+j7_Y5q&z%N?*w7J z-oNo_cHNWs{p^cdIKE)l0k>5;0;ZS0d!$8YL9%U@ zc}Vp8gX84JocpNVqsPo=*l+oTqbv4!94>FV#}xzI>Pv$qs@6eET)||PVs$E>GCpc@ z2j#Hcb&(mK&|bZ%&uLG8zw_3BdH0~n)}GKP8N)r3q+}61tPk8+#6X5x1Fa@sw4od$ z&nfpNZ6QU&xqLmR3rmeD+*OzUeRkAhYfTzGkOkzcKgBy?&J#rmX}MkU^OdZ|jB)4C zL(x;pd=%a7lKfzEPvul3+jY~2DlI5T|BK=l&rnk?^2H?Ep1hetr{XftzWHSCg07)6 zH>}zb{+RI`hz&#IgVQ`yb9@%+h)TsS#@`GmyU%A~a`AbZ` zBO1HJhBhij63FXT`jh4v^AC!>T37#PUb@g*N}HMv%ak`hH~E)y+5?)&rMWO(PTP@RdTD@G`@isEH00hf=C`g|TV03MKW@U=SqtK&Y z8<5~UhUn^GD}{o*eiKT!K~uv6S&1m^-dBS&Zwnp=qPgx9CT`1XW$qd7b!}&*ljFx8 z$2c%9D4Trhm87L9-S&R#QL~jTRE?-|WT&Y0xOm4BdlqKetMwp1)Y2Ma0!5nTL`c}c zV1p`tu1$(|3(HY`8a;llqFJ61D2OYS_(=oL4P~q7_MfTfe3V z#>SIHrj?JYQjW>Ey``08&-uyvjb=5%n1#dZT2}V1pDPFooO3( zpe1T?Ptj%{oHyVHB(&gjaO zHiy_l=ueRgH~F@n?Pu%)e7=03@MrN-u*$B0VA87=8Of*hf2hRCfBRvP6dyFnjO%k# z{TH+IA9`z(;*0Ez_ey9}RCf$E z9VYhg=^M>?!TYztw+_bsmix!Q%jUK~8a5fge1$6~sKS-B0)z2`Z%47D!6FJnd3F*| zDCGP?$#Tn2r65MD=Uigu8~u9CS}Z}BN!decL`b79Rro0P#x=`{R|{KwT@DSIcp9_q z)BtV85Tyy-0gWaN&3^fFOHYYWdz*9gQ$pRO8?xy&t6E3f4JDR0EP3#_FKhuoN?=dO z!aNLqYojg-m~ds*1}$(kjgur!K0P&t;h#zW&XxJpQrKyGj_JTLQp8?+E^p1TA0ZtK zW|$EXVQ)L#vJLu9sJ6Qeo zE};NfnIdiVj$kpMBaB9^QA$kZW9+bIOS7w2P_;~|*|Oy^Izj7(k#B?Awj7Cz2cyPuzo-upxQF`D{O z9SS{|hV|o!I)z`466ko~!Z8|=s^x~9DYlU3^oGvqf7$tAFK`r~=6EuNSc?R5SVjQW zQ;K8L;;$xJwbhqkDU_J-mSghz7Tw=cGvz+ZO;rXM+SI+%I!2d?wsR*w>#L70r;w51 zUo(1{ZSOJxHMv22orb4BY`&Hbk}L<0p&c*4VkUYG8pzOe7;2(Wwbwf%gr+`2ZHg?n z(*QTV+W{?bSxB*JsxDP&m|R1I&9t!UF-w$rP6kP)0lg)%JI5+_EW>Z)1f(=W)I8U- z#BTB+y8OqqlJV){Bk*>neXj;5`7tv^-uH=>Yig4$Rka&0}CxIuBpCc1uu2B%lhTKfeX&Mq}ENz~!}`s)M^` z;j7&J#}}b~k!vSUFN2IcN%8xG`7(h5M^Se+%{3^oVYS8xWmAj_>XsMcAI95Dx;KNtuL?L~!7%%)baTCX^*NnzpjyiIDf_6_bWP>8h1?S-Smc5A>E8XAH?K1r&3a zVsnvRu#cakWhUe%>4_R_cL#TdYb4Kbbsl~j_H5>`kd@pISLxD*dk7-;lJV>Cq5wHcVd;%gYy-UyPdHszv^j)!d0VIEUt9X1$>(W%$cY+dF1&^b*93{PD8j z%QPL9xDy_9HhGW}7@IbMND+Kk_c}2**xT=SQZ{W@&@v>vA=e%SMXgf%?V9{!$;!Fc zs8;t$F!xUL;{5;MF`mSXcIu1XeN6g%jlr!vIa`-ZHqu6-a-yf==xz*>vERjy!yk23 zQ1?yXJ~b2i+<=Gh**2z@Md9z80@GViVR;7f9g+jSG~2K9sg~k#j~0xNw+3aQZCBV- z@}>39JgYG;7H}M`qc~aHD9|X*- z=tjO;O~8bsx`p2+$V>4da=~qHg(=7RUoc1z=#Ue0Laa(nhrsv{&~KWUA=N$eR%o-; z>{!C$P6s0N|A9;VF<;({8jQH<5Bi{GU-{q;`n*|-B6?P-UDO|1O8PNOD#p!HKco3GiOsB>+piR)+B9v zu<-bI9EiA~Mpcx$NYq=K;iQru(hI@VXMt^g`RacJ1%7)D*YtgJcdIlpnm#N(`m${_ zRCkr1 zK7HTVH9cN{?cHgg`ahMs2C(PzCQE}jf!|O{)kkBd2InP32t3$+-V&1B+j-e@GEgiT`b^rc1JE^ z0FCH^?4<*1n;$+_`D=~VwhVzR3ROZdnR?Df*^Z95O=l9F5uBZB#4J=fGq9?>ij1n)Gl%tPmJPoM}XvJ@RV;T5~9lgJ9(7@$^fNwtzmV7q=rvCC#` zKz?AT!6u8aoT};?|5iB^raO59OM^9AXuo0^3z?3^$0h(GXlR|HOgfs0b7f>R%iscI zYDvLNOie0sInKNCoc^&CTs-o;j@T#O=uC5h20zHnJP!+qcJQY{Rfw8(G*TV4*!zgf zs{&B<`jD*Jh_Z?;@o~JqQ!A>1hHSthV%vPLkENFQrRlIft}x+4Z>#n5%d|z9i4)@_ zLXWzeK7Ou!!fgGE`)WsHBfG`WHqKp%zXHE4fRH3NuhfayBw?!4t)x-<2uig%0s(qz zPv`NEKke}z*eYT#J_Wqa);ar=?g`-Kixiv;w*ZCl=LAW zk8Z}m!ZqTdK%4{c+biHi&&(ut{zLh^8QX?bBavajg@Rgk>IXj_e4J;pIciaquEIj# ztp)|HX(^re4|!>^pUTdX>%a>fxhOJ=n=sf^(_UCB3l_ne|3;yjK+yO$D`Quk)vS2l^|`a*+INWx5^A`%jW-RKIkR5d8Y)vd5$aqO>C+S8F#jXEpm7sW zi{^d2G@?1vTk9Vnbv~P(xnbNG0XF=2uKfdI9Pm|*6vJer2iJL;pGzw zg%pH(HL&Z{0Z8Fleh2zK;KDH2CS+orON{@|gZ?dI76~VvNcJ(?VXViY%@Yo*xC&*P zkTozt{<9EQ>?%C(fJqXOu_J}6AF56*GRi$sY6&Itv|qzApBm#G_o$ZG_ykg4Au4nh z|30WI@cI?(E0f5;`9Z6>iy|-aaKx9sEtSdq)$XK+-OJV-r{M}xfz*^hJLCN8bm@J+ zM%QF8x3;y?PB28?O!EYIriQd})L+R=LQ5%qJ(`to$^Mni7nU zB?l;R_;Q{3Lxs;s*Q3VNCA=8mCYGL`kLD0$bz$)|sPT^3C*(JzGOcL=pt9TdXyTC) zkJh(!KX#}T-i&W37lw}`g_D87(!KKealk~mXF)vGMy*#&A zeQ@HtZ>$%K(&6#PGzw)gZY!45!BTdjOg7$9Ou3Zndwc?`LpF=SXF*}q7WnB(Y;<>m zd6qvcToLYZ&4&)$CDctfF$mhVG0^XdRiao<5ci0wk?sT-K{ZX=&Ufj92|T9Gmr2Ej zX)kM3ojJGBq1^{L+yMG$_WVm`S*fa&!^YqLKA>d{8bK1j{9aOBJ?k2VwP*NFb+X7U@`khf zNj)h?7UpN*qrIhV?csqrwE+C!umboSy8C^F2rv~H7v8NsUVm~a zsD)PdrO-5}X(NCRvh_vDpOnXzu)TxG=^W@wMVAADuuX$aRm|s>|9`xqYo9c)v(NxU?{9uU*!7SMFCpVB8w zYxAwakdIP2?}+dkACe`J`pgT@ICi|w{zGZ8@~vJo(c!&9Cf5mHJG2^!`ET8$L7OZ@ zo^tiCPSTjCmmNI}Sai*Cs1he);OEn=Ax=9YzrHs-d{rfyzRMHkAVWopcB|n8{7>bK zaI27l77)^B-lnyl^Ws~m=4qm6XB6jhzzM07qD?g8HU76G?gr=NP6y6*#W6nExlhAq zzQ+4bumd)-LyUMG->~sAmwSmUE{UYnvCO|3;y&B|WNO$L6Oe7k5)L$%tJp*RhJ?e{+&u1d$g#B-VQiRG1-ff{ zoQJWQC1=HTjis$5U7e^;6CKSc-xB}+FA1RoxoQB=bM5DSpQaRl)cUT+bmkl4X4}y* z0N^)9I{%sqT_3WLTcWrXg}0hW6zcwqB!rB%u_d7xcdU!?=*SKFb!S4#{KcsSB~A@W zVe3uyobA#{6J&1~s_$io5Eamz?|^}ry~Yn^8w44#fU~EDEpy5j$Bg35TI7Y2N>L3F z^tsUn2qD4w!V$NT5}|~twuHYlEqkBn$5n?+eoFHJn?)-Uo)n~H-Ux<)a&3nLc2KLV zHkf53{amYSUCI%ahuSYD?c8b|1_B{(gTo!BG<z>Dq;dpEZ!!%)7MGZ6xjt$Hu5&2y?aeTaRIwQcXE%CIZTz=wbay8VTYop^}}{YVHuZ zaE_z5ao0C7MOSzylQjzw6j_i#s{RR*3LZi4!aZkd#IvUt_}^2N@wI8u?MRaxeahW? z+6)qpt|a80uM0U$_r>Ypmu#@D?*~vrg}HCb96n%-LJ4r^NVGPwf(mI#3W7VrBwHUl zTm`hvd@WO!t{1hkUkJQ1_=o&zhgOCJnV6U{6TXL5WBmh=aTDM4HhL z&U{i@!qq9J)D=9t>Y>5aEvJta)k=EH+&SqGdc8_{r&XHQe}A5zG(mjYpZq2Vc4SEU zl2^VY)Y7z|BrXrwujiSmqs2AesNa8Z;$~?ucAI&?NA2kD?E(c@7}9H^>sXvkLi1ph zoo>t1lHlXBSxkAF=Uno)Dl}lTpdtp5Z^ubl6%9@-MZ}r7e-&D(YrqFPL@v3=IA$n% zTVsv_)cr;FJ@^DYv^M$S;jc%Bobw2BMZ^py()e8x{LC6y1z(lZb3F~7G)X`VsU`a+h>3p-+p_B?6yeuBs7Q(PI? z>CN&8elCqa)21HxyW29*{gOO$*>@(z&g@9M>P?gXLiDU~BorR(mJ?dA8hsjRrNDfI z;SljQ_}~`~qukatRaHmA?m#Cs?X_8XkZoF!iNQY19@in;C)5!hbexGt{@w}puspe_ zG3`!`1-5)=)96d|z7bBca;#E4X!AfZ{og4-{AUdjenD!DF2(J?Q05bFt=z{z)+fxE zZhh=-<^t^WoJ>`Q)%;7U+X1%LQO>UhkZH@ZEP4u|>EpUu%h|gA-c8OmSrhTd7v*=d zR5bWS6qul7#5aq!enp7_Er3EW82wZuFQ`sCyXhSKJ#{WBS(>nbVqT}G@MuA*zz|4` zoVPO9i-quvvqeevZtHrBsUvlCSjs9(?Jx-PBaNQuSKYTUl~?jDi2ITmfOMv4n|8P^ zNXdUuG$@m$96>YYKIxd)Rw`ltNX#lWpsl6pVQj9TWP&+Hdw1bUO^>Ixp~NXaG3_ek zv|VwcsypeqcWHR9nGkki$YKc zD9tM&7C8uY$e0F9j$HzJZ~1nY_b(5PyOCru5>0}hQ$gi!h(nU)0PE0|pw|RnvR*L2 zq&w#xFGadf)o$(daziNXt^PD1aJt<3Y$+?c35XTlp0XuZAiHp)~9sYT0X7Q%>jZeLT%n z-~>E;`ZLB`?*DJr*yZ5Bw*+a<+my6(A}-0Sq8eonnLcji;t#oXxbEB&0=M?EYPgYB z5~eHbeOy7VQ~A4h8OW(ZbNp|`aNj;A8^xA~-)Qdu))aZK^nVMvQdP|7Y(Ga~4N+Ap zW?Kh4XOn^3rAlZMuD`BrVxjS5Tos@NQ*+H>*x=F2EsUP29F-bP_qk+Rq&pJO3qLNc z-iwPAa_G-G3yVCkM$$V?8QRn1o;$NnZB<;9f0ZP%!_pLL4zX_7S8*$tDnb3TbK!D6 z>Hi1`i>=tkVkfSI}b;=aFSGG4I53Rv9NrYhL5@3Oa0_o1#$@*~-du`Qn-#8KpA&M|()w1BPvF!Xy@E^F6lnABJi_0F z!TO=k$&fMxkB&i-R;cXO(y9jf)OKXA5SoKWYE9P|M9QKTdV%1AA6KlEWPE03Hw14- zc0pu`^{-Qe{^K+SnIf%&W= zO4Ksd;5dA&0Sp$0&@g4td`DAY(Kbqi4)<$&IHSL~1_=Y!qa%B=($1uJP^!V`@^(6g zaynPrV)J9Y`tSdQU;&EiGl8$`B`E(AHKHKl#gT@tUl-q0>`2cx`KbP1sAOo(1%Yq% z1d>lfg3d^hc}))X&cNh2<(q5nnPvT?3W-1>o3!=KdNid~s9&NH;ILTomRLz{#W=p4 zSrknmU{lb%7_LSlC!wAg{&M~}bi1t$EP6&`I zT-9|!7P9myEr;xLV*_A4a|nNibfsJ*wBPT2X)g9}Ft5>gtp`3hGKt0rl`(p!Q-RAM zUVdY(2By|N>hen6wdM|&S`3OWi8FS(eUcm4*F8ben0xd%Y0=xaRvEXnX>!`55#Gop zm%?ltzNj*iS$@Zlavl?UQ1>R7el;JaGV(2s+=dwA-^gxp{@vq{8HvN84k)L^YQ;_5 z9d4-*qrOSwT-miX#tf#{n;9m@E%$X-&`=H{^6+A%$Tc^HyC-NFner}c5aa6@_3IW* zzF(``F@)lsOkkK#xZ!461Iy-tl;!IP7SsB)>tp53rL+;k=Bx2vpX>5hH*Rm?FRNVp zNy1`W3LG}i3;EP`YMuTTV7l)76L%1j_umG2x~xeB@w`y)Uwaq~VUxQDi6O#ezIeb{ z3%rx#%ov!bQ#dhm8(H_Ah;0XGcCJv@lsTxl(Q)BfWnMkU<$Ci2TsCY*T>!)pJgc{>6y za-FoR;MREdC7VCx%qYkGKkFTjAT%q2K|gaSGKf}VnJ)eU=2{@4I1d@eEvomPUP!a3 ziQ@0k^bcXgbv}K9;J+~pD(iE5(r3vB1tRWxEzH=wZ9f%rN}R@$PNuz@%1JZ1r?!y3 z+4fU7&6hbSrJVe6wTGFFe9q6S`!GyuXm<}h=I zEC5qt)daSF2OqID3L+1XiIngMO;>&wNZgFY!Z)x!S;7@PR_W82$oJhL!P$$PE8Ta% zER$7|;<3&BMqTORE$P_Z+Wi6+5=Wp?7L#u9Cs`lVELap?dFg{{?N+e>Josoza^Jxik+(he$*#T* zL+@p2h0i=UJKF3c2msf_Y5o&al%R8?r?N(ICQ%h`)*yD-SFP#{`p(=|0k2UlGOj^= zK8rgD&algEhgTE8!%DE)j(gVcQo=Qw^o#$o8IsM0$yz`$nuGlv6Si$6)CUlrnj6t? zjWAO*C7we|dk(g@yBL_vXnYrU`h2Z8{+?5pnO*nWnap~3NC{Y^s-97h$x!ao zw7N0=k1az{wyB>*@tG721`r~xq;;7;TA29 zDKbm3KgGP!l;Wm_mUy$|oyAYRi|dM_Qa4MRO>5*tXt@8OCeyAxJnfi-7T~Q}Vo$~$ zoS$Wl!j%fe0_012Qxjm_GB^GjRwU0S3~@oGYKB8W6@(zVKD2o6;kc<@5IjN)nBM-A z(Jb}wSP^Aj!byG41}O)%zBXGJmYE1xWJ()?_of4%{*EJb&}Q9%guURP>EUc~FywN` z*(t-^XXj%Fium%1%`_FM$7#;D>1@0tdI51zsC81zvE<P;%lDE8Dh*qXMP*b)J2*Ukw-Zu%OsoEq3HQ=C&cIOOaj zwhRHVN^COH0r?p6+OVEV6$%(*xO|dmFF|irudc}jc{QbhhzQ#H;&EbSlP4xA?1-_- z^dmpn8ODSO&*ez-0a@g0U%g=2SKWf|X1IGApFzS-d98wPrdw){S;+6AN4VlrMKcILWy_p4JOQX$=4UEpJJy`ZYv zGTS2DWu#ssfWUIr`)Da|697SQwth{bzabS`ud=fop|h+%IOxL=;?Z{(L(@_;Y#jBc zgUh`37K?>hHae*80;xj>=S^?A7S7S2X}a{-!HawWku35-%c|7DbG&|quchl{ZLT>9 zP`^CPRb{XE_;J*?*}qd$O!t43`PVzn@)=?=(v|Ki=^@Ik(bE{{hFTng7Dk>S9mW zI6S|2yR982CgQz=BoexQlL+Rst@F8we^UnWp7}Brq!Ad>h6B^8ymbgtKWZs8yL`qg zZv7-r_6on~AFYb-IQf#lwlHiBcRJ)g>2<6r10R@>hW-%p5a!#vY9i)LiqU~)ek(aL zufMy47LavCZz`yqLmtmJ?0`%)U{%XyUQ}grarMZRKZgyG?DJLkZ&I5*=Hr;IBx~AQm`O1_TD;6FBSURJ+W;glBU|$Yk^D6!`!O`_z~mw zoT!mQ%6E{3u5wIA_ZnodC+@WxTY`Zxy3O-2R_%7=_9|8hSD0NuJGJfX5+-3bg&?y( zLOi|VvHU4T5>A2L;`AM%-%Xgm=8t-T^ng8{w^;OXlNd;0EirGUoM~sr`7DM&_T{eD zaol<)A{ zy);iX@X-4er0)8z&g*ISa#Im$^nml%VRtut8nTSWiZ^Eb-cl*l<+&(-16L`VW|y)V z+e2pvpD&>7|J@Byv+ni$E~m_l2kkJsz@0Zfo&GUob&`g3t)w1}j2-(qb1w1ULyn2U z>qGZkIv=#jKwC^~s5vgVn9)Yjv^RLC+@7bM=Cm;{dv@X~9kDIQHtY{zJ(N=X)YM7; zr7HNi7=>Y;@7#I0m9k$=O0v6OpaEwA-Eio-hIqJ=$|l-!(lB;)``NlPH%~EWj2BW$ z2cU#b|M2#Tf$16|6RVyLkC5-LvHgS0Mg|?=yV_13D7Kn1!@9rPIj|-@|0c;U0L9&zLGer5M!o8H91tt5IR1TTI{_nRz1=1?9=K{GOjwow2gpM zgA;!_h@qB2V@++s$F5QZ+W*@#8{!1pM^hZGsG*XCY490>Fb%9U$Q)Eoc}u)Qm^Nsd zAjU^YrzYo>S#cd#_!ALb?1}k>9S&(aXTj%$7$aT@nuEwo2n1q*lcgkM}Tj2$FM@;3s1@gZ}_dHhqRT!GmRi7wv+MW}mVZn-RH zd-pcsbF->ZGAXm{2M=fljd~krm)gQv1i%UVyp?;pp7JvhPo!oeQ+Nok;=qR=_GL(M zmu|nmg{=K!{nUR62!3tZk83ntXVGlh{aDRR^%Wwh=r?RJFnfX^UF}!J2#yX^?W0Waqueg3Gg^?GHtIIPSZ=Na|j|CWZ01fdHYY zFDzd&Zqw0|Ir1PJamkQSSjJ@icDwbLTz%0|RzGSYo#P&loaGtKx|qj(Poe6w8i#~(wm*e7PYU=s#;a9& zc|1SW-lpOhsoinz0Gd3c{Fp#98lK^c(xi7fV!c1fK`3v1mXSf-u)pOyMY0pCG$Oj2 zilad$^)X#&(7=I9t46jJQniw|LPSw$#54dazu?bvn4oKLD%_X#|D+M~y$#|25<(&pUWd4>xrv@@%nvY0#|gMc{@=2AkFk}wvEB6EbE z?F*HbU3f)|cO`fBMq_14x6pwGk6Gkh?ZZ=FZTl&_&uI6~iEgtIoA4||yEo-0qLUGI zCX1ltcBF)P-w|JIFk+OnRbtHuAAOsqO^13S_LqbQ0JSXC-AVDyt~h&VT4C?3O$+Ya z~ZendTd zeIfS#+MOS~63jA!;TxPvAc2!}Jr=0XL5&ifxelYY?7<1~vi^D!4!mO^bTF;O6vcLS z)st!Gb&tzOzFwceNBA;BcGQi>0b>zjy4u!Zuxh)|+vgLnwdgVFaF5UFb<4jPD5xVsX1xJ792 z4u!#BSVH2IBVgmw)Cm_JOk`mRuqwtoa4n>mb^;=vrDzIEntACaKm#Z5YqCrfRWwthiJDOlmB^0`R2f{>FDL(L0*F|6=Ts}?bT^+&|Et7OVQ6UL)`1~vf|_JayNZQI&>J3*g7TGRBC0U2`Ep98 zDZ2ty6Ao=EVo`I1f5}yHoc?+(UH8Mno>r?Q)+?6p@QL)e({%~g3ylh<4-t|#ubuHc zkFY7J$_g?g2N9Voos6LWDkM9<4_Ndb&GlB*cjjD1yJqP3$K|~wj<3`xTm^5wu{5X) z8Xeat_TP}W0mG@!k5)s;OuoO-z@n3i@gN7%JL<5@f`_`%S@m^^Mfeiz4Vw|exK9*# zZOh=)l+>Z{KNDYW{}d}rFoe=Itd&`Exy}g{*>hrWox>(sM|aB-V{tX=+-#y+iY}t8 zYl*i!%=W80`^jBj8KBPb7isn%mMVv!n*O3C4)^jEqd^}%suVBqHIDK=&*<(4 zOm(%b1rAgHtB1&-SAG1!p3U*UG}5nq0ivqrhL5~KgrZ+w zqTH-8C?Mi7*B$R-UVMIklY0 zuvwJOGGYq5!33m8QGU`*EdG>*92VbeC;Ww_` z5c8@6U&8w~m1WM)cSXG%VW{SuJr_yAeC^%VKT%u(Y6!ci($*1AsTNlCQPrez9*3Ny z$mu!3L>w3Ibhl`@hD^#_0czY-P!lSZ2{}9Fc+LuHOxN|y?{j?K{OKZ}iTxn=OI#!v z+7Yo9PhR~c)u$3G)Y?eW^$()4#8)q}eOQ`DqN!asZaS6RNWfhxy60f{#$uR9W;oEH z&xvMPX+ZjwF{4OY3;BbLdwqorpgzb8F))FExSZLfm6N)gO<-!Seq!BiR+sDwJQg!_w$))-80XOn%R%xu3YseBO;u zOY!61l&+xL584s@+Z3y3E;{M2Q4xV|I_jsg%%L8~?ccxvBzUZ(Zb(r8MXbbtx`q#? z9GCW9-qm23avYtw7gX8K0;lXVi7p_3h+SvM`Sp1Xr4W)}0;##XI>fa5Q3f3CbCKo0 z%h9+QyL+;2n3~8fn=MdngfD9zHP|vgF~*FlW<(5kf^v~!eeH_90M7m+~_GX;_DjzSZ{~tIR5p)i9gMvS*Lu54diAZjY z2&+vSL=#-oXg;RnNzgFVhItrSduy`=JSV3j726a1jxar={}f>n&m zDzX%cb>rOEK%E0y8xG^WaY+5n_LanK;FP!6s7|Rc#=8hr1-2s=#@7UD^O!;0;2;h@ zZno(PPR$XA>u7P0GkIbvvcr#iQhQn0W`Y}jBtC(^z4s~ z8+5{$nOBp%zF^z~EbvkpF!`{aPoaw_$>|sa)><@%NNk`L(rs&rR?lyja->ZDV(^rO zLik*g;?;Xqr0`(=nbWQm;42DYZDrGoD#qfCtRRf(#+k5`6|yLcchnC!bpOzgB+_Ypx)~<^k-3p@vtQ9vh6<dQSqh_Fdl2+}UntkjvJY;jq7zh(>dd8zy5>xM*yqtTC*iKO~6 zc|DGFJq8XjSh)a0f*uFEU_Ut1arKdj%kdHVy?4KuB1*2gK7g0P!;*1=VI+OP?mhPp zdDDJ8x1d-dj9|i>>s>F$h{_ol6-W*8K#w`@69{-DyX!?JvG)wG5yxOQGe5^OAQs(gm{{OB%G?QL3 z@Gg1RK1{`%UknTyITzibCn${!RFGbo%p=d1@gjRJv|4dZ}-q6{6lpZ@+H6ATS{1SC8$;mZRVfRQm(o zPncV-e}OzWNdJ!PtX{61R=&W*WjF@xT-66oj% zTROH=333F$PmkhypN)9T#byC!k;JcCxkEl-jaBH``LG9dpXlGQG!E;)l_pO$k7S`O zsg1sp;)0npJxNHe9&k%M$SZyT9rZMkkv5drlnv2`;uo@iydTu-t=}m0+u*@dr>!(n zO+mY^H&EWJUX8_o){J(u{3bb+^J z7-a>9bBr1r=w3yYW{H!@+8zzLv2z!J+Z5*6gHF9ZFJ(()ETUQhE@MY>(yEoxtpha! zGSD+27ElQ~Mv_-W*~u;}6KP~3INGTGjlyHRfGHMFq3YeudMAsyBYIG3GV=!8DAxOU zs)yrn;gW-FYA)VW8pQQ%WlNRtS}^c+zy6B=)6@^brXZf=U=YUr3ZqWp#DrRcgEAmh%5Eqfvf6D(JaPov z#=>Oq>CVYJCVt7;>q~}i56K#lSfKAl;Gw6QV2fTaYf5MbrXF~(*Za^TkWB%jsP~?h zy;Z5ct^<6vx9q7)X@9G<*vLafSB}O1Y;%Gk3P+&y`g;l;j z#Eu=b=Cqu3Ppsn7@VvpF9^}|Amb_t5^frBV`;>7p02?>ZeT^S$mB*DyeMS{bY&YaG zL!kHoB*u2zPuY4>bb|Pa94m^p>*>2-nAe@|1Hh?hW1vIH>#5_;|0qOj4{ZX0Zg*@n zg?Arjli&*ppJ#g_VSS7Nk*nJn><$XOU9L$`DF7eh-of9{@$;O9j27M1x8b0J*gKKz z{CwC8pY3)IuN>hz=(zf}^&e?__5awllm+txBOt(#6vq)*ovxMf=iJJI^OCG|^!$fF z`ED@}uW6jnrEdeVcc5lUgrPuTvQuII{g5lDw8nO;=PYp(;)E_j7n|+M(7=n*{vIp%%45-$2@$Xrd~j9z96| zGeb5@I?tpmcr}UKgOBY#qS%e+B)rB>3FZAVjv{9|3?mn>&4P|7+t<4D!rwki=E^FC zIo3QC7}19D(7yW$Bi$2`|J3Evlzl|Iky2u1=rIJFBr#wa(m>GF-Gq|N+{uu?@w#Ab zl8_&=lYtTi{(MDJfBvcaR$Jqtl>eacuDTVxUEI#KzVj%H-@CIG3d8hW&~73}1N7%t z`Dewj9*3R7`gMf1n~>$^Um;lAkw!@qf4fA`L&Q2tcPzNMr*jb;lHd!HT`Pbe^`0T$ z=i!|p$@7~iGyyrhcz!^V3uTcn<0=`SF&O2aMmzAx;Gwy&!f@U;j*PItcO-mdIq+zo z%zrx(lcppwQO&-6Y;Ot}(qTOc7}`)GIa7XoYPYZe+32qq3U{dyVUg_NAtFa`%y`ZT zLpd+CIeJWv$MLc`lEJ5VrK|Jb2Gv_ERrir7}d| z67uk#3nG=}1o-E>U4a6q4@sj_iceUEk`8QMJa6qeUH$SHyHnB<2dPx&^~%nOD0RY5c}oD zDrb5zhem+lv0o-yt+(v=OZ>}<3m$qbvjQY}g&_&q_D`ndjH64*z?&sY>ZV42!ty*` XAOB2z4mh_BB?v|?L2DPyvG8)asKJ(8 literal 0 HcmV?d00001 From a7f1b31065088187ead5b6cfc51c024c653b9e2a Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Thu, 23 Jul 2026 18:57:19 +0530 Subject: [PATCH 007/127] Update aws.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/infra/profiles/esignet-standalone/aws.tfvars | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index d896b386e..e91ca577e 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -74,7 +74,7 @@ WIREGUARD_CIDR = "172.0.0.0/8" # Use your actual WireGuard VPN CIDR # Rancher Import Configuration enable_rancher_import = true -rancher_import_url = "" +rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/f25prw8zrsc959n2bk25mn79twtwmpq6hpxphf9xt97dhbm797r99n_c-stb2m.yaml\"" # DNS Records to map — only eSignet-relevant subdomains # Includes hosts for both the esignet-standalone profile and the isolated @@ -97,7 +97,7 @@ mosip_infra_repo_url = "https://github.com/mosip/infra.git" mosip_infra_branch = "es-go-test" # VPC Configuration - Existing VPC to use (discovered by Name tag) -vpc_name = "" +vpc_name = "default" # ── ActiveMQ Configuration ───────────────────────────────────────────────────── # Set enable_activemq_setup = true AND nginx_node_ebs_volume_size_3 > 0 to From 9f859f828104121ea6a7b5f64f23c078f565ed27 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 23 Jul 2026 13:49:04 +0000 Subject: [PATCH 008/127] Terraform files (encrypted state) GitHub Actions - aws-infra Signed-off-by: bhumi46 --- .../infra/esgotest-CONTROL-PLANE-NODE-1.yaml | 19 +++++++ .../implementations/aws/infra/esgotest.yaml | 1 + ...tandalone-es-go-test-terraform.tfstate.gpg | Bin 0 -> 18117 bytes .../implementations/aws/infra/tf-plan.gpg | Bin 50542 -> 61212 bytes .../esgotest-CONTROL-PLANE-NODE-1.yaml | 19 +++++++ .../aws/rke2-cluster/ansible/inventory.yml | 49 ++++++++++++++++++ 6 files changed, 88 insertions(+) create mode 100644 terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml create mode 120000 terraform/implementations/aws/infra/esgotest.yaml create mode 100644 terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg create mode 100644 terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml create mode 100755 terraform/modules/aws/rke2-cluster/ansible/inventory.yml diff --git a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml new file mode 100644 index 000000000..9681f1e26 --- /dev/null +++ b/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +clusters: +- cluster: + certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + server: https://172.31.66.49:6443 + name: esgotest +contexts: +- context: + cluster: esgotest + user: esgotest + name: esgotest +current-context: esgotest +kind: Config +preferences: {} +users: +- name: esgotest + user: + client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/terraform/implementations/aws/infra/esgotest.yaml b/terraform/implementations/aws/infra/esgotest.yaml new file mode 120000 index 000000000..06f0a3f0c --- /dev/null +++ b/terraform/implementations/aws/infra/esgotest.yaml @@ -0,0 +1 @@ +esgotest-CONTROL-PLANE-NODE-1.yaml \ No newline at end of file diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg new file mode 100644 index 0000000000000000000000000000000000000000..10ff45487f1c1c7bc2f1d81538a3dc7f3af45c94 GIT binary patch literal 18117 zcmV(rK<>Yc4Fm}T3g%CRozIYVs{hjJ0mrj$px=@b6D8KDN*6+Vq!px0Rw%gYYyEOq z3}ZIpJy{C^E>73(*YWB$ZiA%N%2c>BPvm^f5{xt?YdR9w-APRsV<a=sa4uJ{p$q`*W49z z6e=|j_boSMMY6Z3M*91d=Us}Lf!BL9+M7h`ES2)cIJbmi zfZ_|O75$gQMc$ne2OFduZF`n!GLO)HJ;Da^&+G}y;0U^hlXH?2Vq3#`1U8CkEIXLx z#O!X!k@G*Lcr)y*4A!(?xbwW79Ca<|)hzxvv|DxXhYp=sIvFbMkgy$B#;B5eyat=< zQzo8sD}vl}tW@a1D9TO=T7V4*Wy6*Ff5=s-@+L9vBx(~XM8w`72;<$RkY0uF>zpzH zyN>GrvcPaEwivmncw9*l2mc1n9A-{6-9&%f<-5u_Ch*_SH$y`nI%ZnTw7(7cFHim8 z7DC5oM+_L83zb8jpNWnhw3X)vj3F98x$T+0G)CLe%Hf2`=dn!z{}6Iov8!y81M{g8 z`J@OF-3JsR?}2qWAJ1{#a(|+6VMZQ<=nJ+=&8Z{!JYiwIfWS@O34`Mbw4WsR z+_O#`W;410kmzgd6e70E%o1Ws*wZzY&vHm_2vrjk+ggP#y+uEC@4l3 z0IrenYp^LL9LKNTeyS&6TxXlEw(1AdXSg;Nb|2}BSFl!JFwmkMI(>^hpZi>m*!5Xz6VcsLFU;;ur2le3?N~P+-w)D zee_P{RbzXgd;r{Q#F?)ySSQs7#l-tvgZc@TnU@$E#Ce7eIXMS({%%~WJUm@|{1~Rl z5Gp@+e3x(2%OS^TOBu!moJr?^Hy|o3aSy40bq)JgEK$K>;>2OB@VN|JqhMmZtatE` z!On}C0X>L&!iV3{ZK+oC$+;?7WR5XupPMu&l%Fx^1N*s}w06FA zi2!NB+5RIx)E2J+=1%z`s6WK^OX2f_8`9^p>V0!h0y8B{1EowLvj!r=HUntEhV$_E+)Gk70 zD~${#C6$+f0todlf`KiyYp0!T`D!f^R(d=<rP zg!l6=wi*my5zGg+?oI6owOol-t$K&erqd_aJ?nxj4m@XieVxB{@4vf}vTC|E zeteEafeYzDGi0X$UKtE7!a9jMLaiFTLb$BD3f14h9d$|&GdD)vg}T_PDJbI|XiF{4 z%F#mXMUBeMQ+||wX{J~~HngobwvM2xeE1f)e+oR|!BYq*>nUai?*+Vnv{tfnj81cV zIC!BcCt6`V7{n+JxFvj8gbK?@B_310WEO#zP$zMdP_71YW>g^DGTU@!%C5Soi1INDqAt}ZlVe)JXW7=t@4-#0y45ZFPO#cNEZd!Y%w@VAd_w}^8$=k#Z}P5K zwRo6bzCRlEXGy;BCLLLed3UxkLy!`0atx-LqTZz1l-_=#xqaNmcBM-mKCP6=Fv<9> zW@pmuM1Num2oKS5C_P;*F4}sScG%SRx5rq^Uktr9Oja0*YUMpaPv4$?S;+N&f^5?h z1WYPHj##cbZpN`3&O=hHQmNOVv?JC#!cE6@y%OH)$PD#L>nvjD<6FHzS5R^~>s*dc zIc)bW0Zq1rXr}I|$;Q=Xz9P>VqY_(9|xQ+l4boc1xlbl`t-J2m?zXk$<7W4y9sqmtb?Wqek0_^+Z`CY|i zg6vB|7=`?yJD)=`w-{@Cl5{KI=iIrOHnveF9~U5w`oBO~A+-j`TBPa-(U)2}Q?72R ze@!mkDZ5T0AL%%E+(8|TG6XpewkY3vNWq7u@#LM0)zY56_`5A!$3>%F<&Wpj`uL1mZD`24bt=6`vFrTGqhXy_{n zI9JIh^F_2%0?cL##+o>mG(!M)W??1_ynB6h3By}3mhSw~l|jbXL2+ZoRQGfEd}=Y3 zd4@~*o7cnE?)f8koYWd7t*Ep+@#Sb`kUz>ZNk_GKVd^ z0#dYe$%@`t&2O5o*#{RBJL%|V#QcMEeeg%EH+Jjfyb5&B zu$^A=Jap^t(>xFM$V|9wK+4pt`SqI!&$K6@XLX+#+-YUI9B5Ct$}ORsVh*gQX{huU zqAweiE`;VLe7wDJfdmhEm9e@WnV~13&G`}oU;$6~E{Fcqz@oH1Jl-^0)%PLl3f=HP zXsK0S0o5=wc%IIbV8XJnS<>%mxS`8+EHwT@%)IZR?-DD>e5*y zb#=Y-F+v1gj?oPzce{IH0u}xm)+odi60Gp)G*7()Rp9cM z9w@EWRA-u+-7sjGVnW7XQG}xH{eke*)o0gnEHJWK>HPX>p`V+Az8~X4H_QV_(!fBc z3mN8T-z}pYuVCttWswk5S2G3BK^dH=8*K)T-6C8$3xHnaJnST9vvN~zI|?JPqtB_Y zs>BMoNgX@loKBunf00C|8M!tQvcTWO+q->CJ)sO@ z(joa=etYY=aVH8%IT9xhai5AloP{aeeLLUkb*n)fZ#Ks|z@;>(o{7i;)bh5a;Ic;$R*)K&s%)o;Gv zd^S;_Pr#ZqU7hxrnAMWRUJnCjMO6=Fe#M16xouCmf$e}?)A*zsxUJrO3gN~-$%%Ef3GK0A=og(L z$+sY8`HQP?P0LEAXk^(*PNSA}$GCNGDbZ}jwE0l!+$<>t+o44>w9IMWYGN1#^d8ez zzWwHcC}5Y-m^g8`N*RFi=eiF)dCLl5R1!oLdJ;1MN z3~;z{DC5vkX(pF|8hCz{Ol0cjD|g#+1;|PRZ)91!GQ8Yd3#LUlg6q-;4m0ducd7L@ znHx?{6lD~Ie9~vN3Gg3$fbEAKA|Ygb72W@B008VcCxZ{;3`b$&tI9SppmG(7>Ja#N6w zj0&2Z%8cXTi75$RX`s>TD5&|Yn%hfl_>K3vR=pthuP|7%j>az4341Y%?R(?P=dv%c zFa#*#?ue5CJYVg!uv4y5zkubw>+S1buHca}PaaTdCvy;uWb#5)yW9(gU172pwJ}Kt zfn50BZBH-xA?w>l3OlUvWF80ea}A#%h>0$Q3*$>(fF5WdKYom_h~1Lgg?sK6ZRyJ} z3eKS$=Ixa~TwM$~yejS4hO#UjXIlGh@PDc0L&2Zs5aO8{gimgW9HQ`BF!nVmD7H@K z2!(UP&hGO9&ACx#y7IW&Ub`AXbi#$7mix`4AT3u<#o{1TSXC*|b=?S}-KQ13)WtgK z(!#5Fq;tzrMAiBA`oGO)G?SqaAoH_7e?dZC*g}&S1vg{Xi@H?&mQl&ob0gWPWTxJv z>()j&;i2aoqN%`w$X&4`7;m%t1y7pun77H2qJMvEhl;HdQyUIY+IAc(+zTDoq1W`G zrK2My%?a+kE|H+A0BZDq(Bd6rx28>KR?gVvde1a?J((kP%=O-Xw{Sl7IK z6khgc*lnwowMpW+(+BnE0lLIeIPz|`WERv9g>^z*gRurWMBQG{C8nB-m5b-fa0@L2%qJgL{Wm3gEw z@{_IR1Zp$Jf6Pc@>6`{<3m%jctLTel!YQ0ILSZ<#Yf8tZvmF|MZtqLe$H7|8u(~+;WnX@a#Dht_Q%xxoquX&MA+rJ6@ ze|-t=wO&Cr-1hLjVn3$gF&~i-Fl9-4^KhKfyyuz{rk2SV@Lb$*mStNU;?=+R9kc{{ zB2q){KskuNaQPH;Q$5Qt4z1)dlA-dQlZyjYgD40;+n5WMA@HQe%oHQ5aPEa(%*juN zh)GS+v8e~yhS~J(YsFbr^Sw!$?|wGy!jkE!$SS}(^0Zi+z}#Q#r^}LtSWSKMIiIod zIDF?*ll`4eoGiFce`TW}JDP&)2>t_bQ@v`{Gk$TAvo{?@Atzl>b}@9ktVTl*-Pc6H zuAo#U9&XlhluyNdw1AtppsGB*w27Ok=4yg-b@}SYZq+9qlj)QNkbg$CWYD7-b6V_T z>)vQOl&QoRw`N|;DK5&E!wS%ebu|Q%CE0g~RP!#17zx zW#pun&KngIm|`HtHr$24B3Owy3!LX#%dVV4IdWvpU&Sc!;!7!n@r)Zy?fCWC4wrFN z)l@77WFkSCqW)GvHNY&(G~kP&~PBC0S)wV`jaCL|5; zJd#4kf;fhu+{_=)p+r`Ec?N-~eu!FJe5v(zj+A0~JO4k)`Z|oo`5&e2QyTXIu1hSWi!->u9qTJMD;4q`})Ia%wAn9g7#?v4Nh7@~VJG}kZCE8;m zBNo=WdqXSQs9}H*vADB`PI_v6^y42X0b8WLVeI|uUDWg4?h=Ej$EYua+ZdNnI!`YF zs8uq6%OJg#G7=;^PZ49?nLKUp(RYHa8&J|G!I1X#sKv$bqz*=yNmKDj69XTCJ+a0D zm+z=^{QA-$ofh66aztF^M_|mzz`N)lt>YO)gX(YAUr4s>4Fo`K zV-#o>=>}F{PA%fDSoQK-kRJgke66@nc`~#GOt3TDawKi`1k#bqSa%Ly?F0O=tpZ0m zwaP;QRt`;ktn$(~*?sn5KFeFX{JNk!e}me<1bfubFdiBNRchR%I=dqrUId~1^w(@l z>7wX?L_fat0w!MM!zl&;-D^%eovgh8Px<%{S(}W%z<=;(*)|12 zs~VR52u}<@w0*CT^F~%4ceMOK0(=dyB@<6{d+1=P$%(nTsM>L&z`0LgAukdD=9jkO zSIND73J0$~_Y4*9F!jDl5RixZR1>!&4a1vH6vtQrx%_Jtm$H#h@Ow=-`PoO=1qieI zS$MtJC%!c94{UZ~J#R&^**Pfe+XtifR1*Te40Of2Uc~UJKfrUn=qmVOc(3T8rcf!wljwTgoDtguLc zTsfNv7R$bb@Lgrvhd9M?aPt zp4_~JSYiRAVc@x8owkTjGyj{QccTJ(Xm4+|!DODCA9v#@B*bR{VpUuhlc-IT%(8fb zJC*1FOGCWGVh|zOmM_p7IV)c>SXf4~2hRPLTrlcGsmx;hP@ZFA+G6Z@h}F6OiqY1k6aRi-Wx%|7k4)x0J$Ol}D=M5!m6Fin_F~^unBrnC@mbZ=Xr&r9gWAZX8a{7dH9%j~ltlKVLVM@%d`SFR9nLavr7!^~;+jSoY3fyIs>cLhdCZMVsjd{xpi}l&mJ32yCS!s=2uUL!+ zM~(WO_!~t&{-f$f7nBKZubJO-;0Az`aM&xO9~JKYq7Qv!nc5qcY%u`6JYtQkT&i~n z>f`kc0MN>;ECIFrU?P%jt8+UeTq?UPb#^8iYINo9oi&)oA|c_mf!@{yYlJt=w7vtx z-?rd);3K|#AOJK9uZ;B$-ny^mgsYq;3gl_XRqY#3o-PV30buqdzWZOKxkY4z1RM6V zqUVnRUOIZa$m^`GE)aY~p^JB2V7Tp``!@Y*yhS<%xI7kcEEAhvj*stb?}pYNV&NmL zENfNX(>Vm;ZsHm|kpFp>Gy|k_6-?;uI7}ePpTMC1CZMh<+qf2?xZ1@4v6c8?S~M7D z3Mvnjx4*=09PI)$tlmyRM4gk8k#yLpf;_PX|H8N>iwa?C!LYX5Flfh*r_c}eR!G2&zG#oFu`78hiXvuB zrBdTEE43NQgXuDnMZg8x3Clfa3Y-sN&$tiT+6=iP6cy^*7<*Ifv+7YC@aUuHT=F$# znRv!(qHjGze|HbC)o_fyQ^3m$8yS$@=7LX8df<-;+5G&*yxD9J4jo5TPU>2yNmM7x zOYaJe>JisZq*<^XGIF!JY0hz?U@Cx_&ucqH00|Lv=qDf|Lp*JJJ4}A4o%aRt<3noB z384*_7XTCOm0t}@=x5e#Hk3&-AuqK_uBgo6&K79;g$mr0c{_m;O|9s8FKnei|5>|X z&U2552u(4z4-y5;u<&3Wg8hi#-4?rG1&x?$N$Su+WHLGZ{NhjPU?J*+x^qD9bk4Tl zsNRSRHFa5&3w?BV%Z-^|NzNNbL2%q+RrT*kEd}6z3%w7?uZCuvyUNDe3y1maa9T#b zNjERKapuH>z?sNQb{8+zw&H~gSw@O8n^dGM|u;Og9szi*qY=kqZHHYodH>*w6O z`Er_$f~Ktd?*%5G`uRmB(*VlQV5fDWi*(0$&+mw)SJ(w!=X)Ah2qxQ|pgff9LY3{j zT8+)>07Y_=YWk~7ERZ#}({u#(4&jGV8$?;3MzSyg@E`;XZ$3mKs|an9a!2AzH5d;o zz6qC9rm!TkwtwsuH}0O6mPVb=;I{8t=ACW5fs(TSw5N|yYJ=9^R1(JZAx}~$Cv}sQ zq>l*&6J2{-;r+D3Wd$%wH5fq~_q0}q+||XK{|e!>J*)DmG`rjL45`kKJ^3v-bcgRI z%^Zh$$pgSbgFXnt)^mlbhJ9fMQJ|oAJUML2-ms1;m^dr#gWpH7O58UeeK-Ej3BB+q z;>k?(Q*@1$Z#OZ-+H5!Uz3yg=WQ4~>wMID-{T;)vcU`mXmNDH)cl`c)D&j^vc#7IK zCWr%3nYO6(`e>{bme@Sdy*=_5@+7=~jaG!DcIL7p45Ma_YeS@&vRo1F`MDNud0?NY z_1u4N%_ze7H7kIIat9F?2B(5Y65fQ%`A zNV+~p@@zI}60q{kA6KtVPkZ9QBs1Pjm!a%%-A0j_^t;5;)R12_^3dwhinsou1TZe} zqTcqLf*|A}#~D0lkDvbZ=W%=7{f?a{0ve_~@gz1OOp;u;O2j5t?XEw0rCq4PJ`yqc z+ND)yXSUl|qn;;of$AsLX`DxE-Qmsweg;LlF7Z-ZuYgrm4#Cm}SoBTXFn;|d=~LTt z|4kC=>o|x50&T_HM7b|vX0hx`jycz~O#8G0ot7(mFYnF{@+3Nr1vg zHb<42Zrj^9j(X+L1tXWTff%Ps7##HDOdI^DvFbl;3fr+3#fkz1Im+km*C6!=Ld*(+ zwP45c6)@i^3v)a}GSM@quiQxNT{VQ{GeAo>N)r#Ehp zdjE^xBA2V=0^eIYL<_oY_&-(vj6Z}Y?L~{5tfYPlVh?FI!k9Iy-><{pil9Ybi4%YU zA{`kAVPM_nMIipZI4DgkaaRA}8sySjyf&=Ye#)wvlt2MwFeT^+DN+DI1jUbe83h35 zN=ZyY7uAaTmXU0^ii-|}{GC86Opi+6C}=P8(8op)^=3(T*A~Fvh4bdv-S6G!YFNB< z^L$el&I_p1AaT$S7}r1Tx0FPhC&npC+c4&>CJGK9@{ziAU`NW+YRxe z=@7<*24mheW{e5AxZJ_!X40C2AAuE-IUPaIQimb)2WGjtM zFpCwouQ1KF3D|h5r*oKGH3w!rB=PXcz9K`By)yOf8a(&~P!zG)G^r2m<`rKV|N1!h z#|)7!GKVTh`cdt+ktJ5-7?o(AAg#Q5H|z`P&ZEFZOkmt-6xO3~Qzz%Ed2r*wokJhS zcAF!>P>eVpk*XBQxt_@eds8PCi1ACjiW+yifq;)+{Ir8G-e>q=f;3bCs_KnLEJ-Pk zp#XB&C&W1fqOK|JqCqUii}K(d)4(6{qLHmiY;1%k$&fSa;UAkj(cr+eHVab zGLf2%C5AmHiR0Nzo%zJ|nUe_m7tB{cB6hhv%RusItA$N4|148X4jgNet984&K+ zMp}rtON8mghEC%-Rj3&AVvx5?VgAh&S8XL2uJlWTkfmPlCFVW1xrWg?dY@abLKpx; z_aQ9on*e_kkd9O?O>PgJxu<8po8>17Zey9rGM0^{3eRyADQ8JqpeO=_+7NRPIOw71 z4#la^&`j^{X90EC;E{U=8HQPAu(1HRKn+S2eE8HoH+~7^o0U(R?y@}BF}1Y`p=k5A z4NT@E?Mw(0$UE4D`T}?5-s{<c?SBhoAb?Ms%uv;G?9EHgX*#gHO|w6jXoTz|XxFkhr-FNHZx95&%$*w9 zU2rHzN8k1tN}|Q5mBE7hV3Fx!(CqSqTFnu{L)`KK%j^TmMkYwvAp7KpexW zUdah<*a3>+D#`c)hy<&+d<~7zu-KX8pN2p;+DBjXalI7gc{i}4xWN0Sq5g$nRn;wb=M@wD>Fy^>$Cd}O zR`M}-7ZvfstHO;qM%QoP3vVKGcjykG@7+D`BJd)|?%POTtBd`$AcWcY=C#j>_ioRC z#7`(p;BE?m7rW8!j3rj8l(~dCX{Wz1o9(&_NE`pLf!tZ!szwlLyFHmKUNcGNK}}RB9*4PXY(c$ zT5mmsdTAK60H(sc9OVKU zi^NYeIkCoo`6OHk7lNQnCrGV+edx2mnh1_5IVGzGm@}b_LL{yS{rQyp5k#BcubNK?@ z$Qa68swRNU@6Qe{wA*NlPW3HCOo!wIm_-}*cJ^-5$a#OKUB@nZd)5Fi{$w5)gaV&k z>a;jo@9F}Mp%VezDL=Z$w2?0qm2mjotOOz8pDIha?$$UW?a`2HO8QpLWtkNK5HE2i z8PyMG_Ig1?aL)OqK0KGg$^!UbE|iD>#+EZ*U@XR5;U1?xEhyD$u?^R1R@RVni`+3W zL7Ba7(A2xsf(&{3^%;c*tLDuqHQ2)4KA?QCfN#N#Wjn9S4mwpuC6Z-IAR-8F<^sps zPSRDS&Uw5WUK}5sjyOU`=@I|A~Nv5e4Nowe!hB_Uq7HHD_WKp9-88K|jAmC5gM2 z(JL#(y0=IE?Vs<9pKs${J|rjo6TXZ6d5br&zT-mO$v?uXl=k>-d5mA&k`L0kKS{0) zI&%17qxobdz5~E+5Ma+$JpkT;(h}UXPW_tH(?-57(k=50LW-(>GwZm`vMJU{jM~qq zf8ZOw@v8D%ws@TF}*w)g2)5U_EhTnaNAi3BZqK!BXP!VV9uYHApGyoB!qW zv}GO^kIob>Cnb363m#eL;2~$gFvTc_9Lmpxcxf0GM%*?swXTDyzxX!JG21-&78=P0;4nX2)(@0|+=jL?hWrE}8Gn+c9NPP{#m<$}a z*)ezsho$#eP;;ogk10PM27vX?;5$$v6DmW?mZGai!&p}mqqV{0zOVsAp8YvDqo+7h znX-@t?UDlQ%*q@%g_5LN&W_k-&Yd-D4g@cJuAkpU(uCZ5K4DDKW2C{ufHH&;$N5R{ z)NtE^t83~;;L>_)5*w*MvzP^}=uE&Sz{TqXV$#C&x_Z}(>1;Ixswcdd5a&aIRhu&a zIkU~&s!SM2q%%aV^ZHg%7^Q|s&b-_CGYlN8m!-dki)eQdcfhZdt!mpVp>1kG%6*M4DakK5PACU zOyV;!1p&a&y!g4V|I0YuJ}XWiZyNv_7>$KTsyh9Gw39j)pR9lG-DC?vQ4$Nb#9l$G zV-SS>%5wJ0 zZV42z#%s^!()U=QM=C69CGLNQ`p@0`@*_gq&VPmx0{9L@C0H=>codjRsX~hub$Jbf ztih`nG-V@Nl@oqcqsaXtFrX`2(%c1pD#oB#qKn82g?Mzb<-*eP2ah+)V0q+hsEC}4 z&SA}sm>Kl(i@u(F{bQP{628829IQ}+ctQmsO7E9&okFy&*mhL_%kQ?)=KSS5sei#r zyCq9rpM1iU5k;#F`p`O?hFg~FLUa<~{G4N~vMFSa7n6Jeh6Cs3#H&d34V4OVMUZP! z(cCpiFaNOAMxjLDVjG&?~w;lG|zn^M6 zB=2ZWU?^(GZywu9TTEvwi1FxZs6aE7r%;4=<;tA1bqH06Ngb9FkV6dC;(q@g#^Iqg zNhGJ_1oKWeliA*j-a#r1gib(fg>6Qnr|y2>WQ9^DjX+cYf7Rj^2DE13_iAoby{FS| zE-o6M*|zhE3|H6oZ~K7=i|Ii*FOY1<*s@OE(Bc`FN05<}Eg z`?vu94-Ktw*MsQ{^N9T!Nkv#q(bjmz_Dz8WG&;R?tIl6Uk`w@J?E6!05B|8vd=a$O zZE(A)!}28ZdZT>|_Iht~H*VR;u=7oSGW8({48y4~wIc4wj~fvqybyK(B@?d6W zp2-X~KTwdU3*;yE3I1ACRF&AFBIDb}FdPt%QH%2P^`O|73=vOLBV@L*vcdt!{uBWB zZ(RwntV$@-P(AF_=kXl3mcDb%QVu*T9Xt9AE=@z5B8?-b7Ay)r5#O4dEPa6-qXw@$ zON3$pb|_F1wYS_h>o;KEYrN~fb-Wa3={%+3o!6l2xE784!?ZOe0g{Jg$)E( z=cB$|0NvuQ>mX{a(W-!~W5ZV-2(Ef0wrb?8g@m*_;R|ty)a9;4=Ezofgs2&FC(qec z^^F=BZPeU2vHk2wIcM0)ssgKu&TZ{@fs%<^GIy|F!DYBn4$H1ng43)e6pC|UG!%^! zqtb5rH6?E8+?h{jumTvm0zZ46_&dsg@1QGHwEhp!G+5N9b_nuRxvZuEkVK`9Vh^8P zbMOyEQ|DqogsO7)^c%G*{g4{3d=6cw4!Qy+-1%?VwbZ#v8}lMp`yTaE@8%B5fwWZ) zTUw?KUJ)w5QD#!fkr#r#6OCRG@nGi<{-ZI87kcbH_6kQt;xN23dybgwLTH|1^Dd)N z6QSnUurN_Dth)GFz>TYdpd2m4g_T;o^zZhf1v$4Wk!hq`QgdI4@9j|2vGl#)^ApoO zmO?iCa+n!yslS6R=T~VWV|nxUuI~H4JB0o+;g{?R>J{G&~Oxuz*!@j)pmJTO>M^Q22@l)caXSt%VXnFiDHy3a(kWO8v zD3X1MK`o8s^>&{VdPj`sonV5sWlP(8BEI;q-%;bFU-2ap0cO35g=z?=Otj^VhjK+;zTiKe7WmvH}d{($Qon4-rlF;ATp z^)uBY(W+Y@OIJ|Q6rgb0^a4YCA?zB_ozdM@=x<&X$g7I zOaB5!QsTXC$4UWf2u8^F^MQnv-pu32dK~5(0kW3sxc~)*<+I+-GQZaeUy=?w@~yLr zCqgU(rzg*FgR2zOMJwh;qvi$1UvWm+miC0S+6>){W2|JL{D z?s7jYS!5xa;iI>P{I55_ebDtym&zd9Mt~dSO$@u-3|UzJ5_$M$^W>F@5!0)vh$SPa zQDtUa^oK{b2j;{bj4YXi&`#%`bQF52(LpZF<~Y;3)rd!8#fN|bj@9YzHjReXTPg~E z__)*`+>zT?ib$}laN6imk>A&7y9s~*G~`!#^mHudFJ9htbz|4j0iPT!CU?Zz;7#ZW z?{&in1!{Opkb5%zCA_SiDWk(&$)F@jjVrIGl_8&ft0bObXJz1$1zs>NxM;0sx=LoH z!PjAiLLrF8J$=J#Dxyxk4IFYFes0bglJ>F}hl`ZNmn$ z7lVY8d+>d}oxB0y0E{$<*y{5SufJ-q%4judXaGoepHs4}5X1U>mU4RvT&)( zh$%(KYY=Dki6ZRJ+(iWls$JUGx!TJUM>K{UrUVAhL|i)AvrJR*~tL;Pj>CD{sJ_Y;MNH1rRXx?u*^nn zL}E5QSu4ndopLAV+V@lW@B(g@lD|^RqFR@ ziT^{fpbdilOOwCT+Ao-G193F8YY=dJk!1(- zMx^NxAQxoyacI|b!y80o)W6q7v}Svwl4Acy^@)_7=`A10YY*A*zBD}d4Ygs-hnt3M zP{Qq8eRc?U`C;vUy`S=GBK^o}9^iwk((Pv0!%^?ARyd?dU%t(BEc=Dj-irQYomefC z3rJIqIh{g>)d~e&R#Mm81b%V35u{PX0ec+zU_P0aubU3I3_KQIyvHT05v0a_wzcB+ z0R3|n4u>f*@LV3XXIATUV`>VTkw}QH?eFct+GQ>GM-%0Z2l6EC(%FZ~aWS*9(+t}T zwA(5iunvcChV;>vBJP7!JDZm03G3U&uU;MXU9YkNprpVYS!aZgjlc$|tX;zp&n`2D zVv8A@N6>R%3d;%;n=}&g7_S%Ks6_ zMt3qTKQmv3W%BQ(SU2k__1-uyDZ8E-T1@f~*6B&a!{c3nCecZzTF9L(+E4rTZ_?GC zb!@P_@d748`X)xRJS%QA${F^slVK1uMjcd!)^Xfn)61GaepNBG4itN|$6MJoc}HAB zH?7jR>gzanuI~|amxV%ehr;$w+eLACaEtbRstR9}?;GUl2!&o;Z2Gpgr8OHxTThqM ztd;-+`sO1^Q_xDs_pzYh2|4OX_7>4|bLD*R(BKVZpjOMdHC3+u_M{&x5Vi4QU0XPr zPO_-ACwOr#-U=DG+Ja&$I#cO+<*RHSI+XxqnwZ+bv`hD9;Y_9h znO0MK3RUc+qb2n!%wqhoJmU+HzWpc7-;4gY5ac~t4rEK`8VQZn4ED*t?Ca4w!fBDY zM(bD2BAX86ZIJtM@CswiJ6V%duEM3ij9sft&A?19xUvi9LzdeAu%~vAx>^07E5hNF z=2}*`m}ky^Ua`92AexfH?-Hbb5Jf7dGo06jDkJ@12LRX{2B`v9Yl!hfPd_LB9gZeB z&we=-JzUZ{0-IJPV4%7w8);#hcxOJp3aDq4rni0*%Hx!Ek_tiL|BObD;q28oRFpiH zP1&SZ^y=HhbIT)LxL*gPCh7qOzau%g7Q3;r6r*bUKy8Ro;%sCAe+%|r1ypckx(4be zh8{FGg~7Ew7)I;`Sk3VI7<+%rn?|gDDzZoAv7ows_KHm4DYP!107=EG&(mQG>K$ZB zFt$pVO|wTLRBP$ETilm>y8I2CIfZm&ny5hPW5q(iWzx0H!GRLysBT64j_YScWuN5( zfoQg2i48lNguF+4$07tKibbaWWaWoFqf57J+ILu9hM-sX_^5t!+WZOvD~TUom4ST} zaC{brCV}<5N_=GG>a2*aD)pDnu_Z{^UdshRy=HgpGuTNT$vgmiX=4Ws?Qwg2S;dF3 z?9J@ocwZ8tE}tyzcB#fVPgTBVO;}OJl;94v#i*He^RSMPWNn;Rn+I2fj~&ntTjpBi z3U{_d44~Ol{hj#EF5Nu$-ibs)HrEV3Gy-!7EDRB1?nF`~RiMXET16?Ue@9%^U578V zMDDiq)H9|{2NCK9Ri>NblF4rVKg7{jx1!e->XHBaZ`^@Ym#6VQlVGb9MHnmMOi+#J z^esgi$5@QFtIFw|l63@0Bxg+i+EB;KbIIcFhJ50o`>@M3;7*m3%t$Y%+#sbj0U2Yz zy&lfX<1zp6Ys(BKV{MMhi&A~pgR+Gd^*G(dA8dYRY>PW?8{U{%(VX5#wfy&V25NAB z{j42TOzFyq$5WDQ!6n$Gn{j!12~Ww$+u~|!sF<<0MBzgMi2phml>svo7y9Gheds@N zif-sd;?;Yl-_J-a!F<`ow-c++ekUsh>Wqzx_-*exn*T`wOGo1O*$Kq((X8cp9;0J; z7Y*X8G0a+H&!2y}nR!0hqo^tZ&0G*!d&~*6neFs0`Hq))f5+&~8038^;!IU2FJ;!4 z{ACINYX^{f>)Jid4e!P8@mv6cQExGOi`KmPKnns!P-jwcS0zf%JAsNm!NGZtGUKke zb}>v=%)ibYo4eBYq>{zTEAlFrRn_!FI54|6kRiqey%S@?uEKoBOi*P>iqD}>Q!o;o zyMI!PNcD#80KT!@WQ=fTOEyp7-Zt&I6dc=u@x|3ro%Zfx7EfqrD@sErT$@bRyjfMV zj4H9E9Ky9fms^a=6QX31y3j$)qij_iFx@Qm#u6dQkL&WoP~|b4{&p2^ADAYC3ZL+7 zLE?Cy8Ez1Qz|`evNLkb5aPR*2VbwmjW*?Owr=*nb@hAm*9-F2a)|kkT9ABWF%h(K6 z0I$GgbHU|pFV;^4V@lXjc_Gp0;U(71KN5k7SDa2`aD63_o3UFwrs*x8IqA5fZN6cF=JpYta=JkuOQbFh)Jt{_= zYx=~Bz;-cMG#2f$pV}q85~*#U-r%(o?j3zTRz7c8W4qCm2s)oEfH$YiKL?P0;V7CZ zd|jGv(9WxC^Bp^c2Z%Gs*d*v1RUg%OV1bQll^11~3#}G>JHoyGgqC9k4gOb5$%uIu z4EnNp%y`$h?DLIbQ)opiU}*&Pp*r&L)5DhW0xg5dSSM5n9{gL;VDGMmf(gwYRJ%O<2vqitF-}p?7`=N zzdLHc6(?fXL$EchyD9c5f_zlxOv}TJyK;7u0kj57`7KGrf&ZP<>LKI!{R79P>e8_| zhpg*sN;lqE33BDO_{m=jML|X*r28mE*+T6rZJbp2@RXkP%Iz7bgP1I68~_J?9jftS zzVhz8%TszeEbNBAUUZ7+7D0pX4Y;QvNIGI;e;>`l&l~)lqsPNq|4tOyX_d9A?)dqu~ zuizg3L(o3bCLKq3;Rk{HhS+pFE`v>kMBDh;b=^UPXQ#vWYNRnwP8-kCFoHS3O|syb@d3`-jQoOk(b*>;CVY$}U>fg6jAgKt(CJrR4=UQl@gzE1N?HC0_=7R4FeSp^5UlRpHc3;7F5Tm?0^hPKfSm~S=`Jl6+Y(A8Z z)D#j)jAz;B{3Fw!un_THY+XX45O{j*EmFNzr4}|e-%w(?>!lQlht)QyOl|22MS(vV z-rRLNu=2(d&4_?@L3+%Te~GDb2`GJu!~TYcU&+Rb@>ic(kE^lE2nMFT>6Jd99D;@h8@dg88c#&Y&cDMX^I?EYUJa|UQX@@S_t($%1IKRweV+9PD;4QHdi zlJ*L6TB2xK0eY4H^m7V&%7&}iqar|>vGYAj8_tK9daEGQnwh+gq!BEUvp8DlJ*U$lL{%N8}@#xHl*NIL9K@PjG+D_gpfip-_Uqp0`4q zV;#5*?oH1rLlvDBp~MVT?LURl9P$sR?)yF-!RhRet{bT38(b#LTPOKhw!31{1;|!R zQb|5e8Z7_qgS%b5h!~8M? zbJMWwL>T=Y$4Vx0PD6u5#vvMIm!Kqn_5~$>n)#ryD&T_0$sF(fq*qx3`m?*6LmEve ztxf9}6!4`qb(cgtAYmFu`>TV)JD_vkeL9iomsh@w6c!d22-9HlPz0w$|0! z%(>vDmyodUk-e1Phm$L?1yyXBLXjT8W!wFZdG4G8*Z|Mq=?bGJ@s3N<1K7!|b$Onm z|H-XAvq6R*S&YEEl<5D>3TZ&FUt8SLRP@f1EqF10CalfjzfITiM1{Q08V^0FSgzbsSX{6MdUcrU#D@7&$ zED^yS{q1Z~26a&7ZI~y_YUP?{P$vkp(&v$%Mx*t8TGSwL(KxBigtdF0kvvt-9=n$e zo%So$8zQu-G@>AnKiAch(oC?*d#OYx&$>gA*gMoq_DUZOOK|#UlNTwRcE>$Y>c1=N z9AhQ9n*cctU{E+NetbAmVqB_3uMKKCuA}`~d*NTMzLN*y<9n!KLif>-2);S=(lP=L zVRl=!W%pZWLDL@I$nS{;TDrE*`Tw#Z9Icsa13_csGoO9H008d?0b1i0#~ahtz#7+itSnH{Y0nsv+o9jj zT`w$L!7VI*m$~>SO*>j%1@i_;e&vu|mW+KsM^WE5{@FTCU=bX%{sI!h3UMsEeRhET z|K5l~;uB}9av7_CYui(7_)yM56{c$5KN)Id>+w*zUp!0STU3)Gg%lW@Wxf|Zz(HlD z?=}Ot|M+V=5@ny>w?~`Fsw%UT?;-Jo2bft4?QxAztgMlq!(AM%#!sHZFOxsT+2t4Q zS#s9jd>rvdkq0rtB^*WVnOfC0m5`0K$;S-611hsyUD!XP-UE?~mYl^hcP_Zs>c{9O z<$&sdT8q%|puf3WSz+@=9hw+@3>0TjywX|O7~XJUfM3?Rmca_xuhr>|)WcDo<}4gD zh~o|F7ceb;s$|Ay&irKgEw`E^eSl-uKW0Lu-O6e+0mzu`3Hl+-yspwi9VSM6Q2JM} z4%B}M?E*4F*M=UtM>OV&<%#``hu!HxWlogYq_xGbP1;uOYc*1Vy##`*4SYnN)MKKw zD}kqvxq|1Cb7a_g!6fT5GpSW%q3_z=0MaB{RJ9D8&yPE4ZfCeFw7Pnm;eh*&_u7(U zG1$B$$>5&LcB8{PY9IA8{GwWzha1OWyvJ{iDOyS9ORCodjWT|RVw5R)Y&7PEVcffy z>M=Bsg~6_|?2Y6cN*_(v(>INGXcl`HGDqKm_1O3dhMqG~&cS-1u*~$(d+SRy8(W8; z*$$~YCm|8n=7a%w<|eo4N4cRVC1eG@3~_%if_r^1c|5y_D~fARt3Y1SOzHG0{ucr`cr2zkrsp*-Br;QzvUyWHV307^12&hcyCdi!zNc|Y`5q+F*Al8$dx@LEdeOLqgCPHNX!lu0m1H&L0NFWV5Fs@%rq_cADBpnxzI&62xzalO&&V8F7A$ zu2zW)A>X$IxBT#MyDMr{THz}-e;iq3aVxL0P7_!gXXb1kJj8npmyUuurja*K&t6SF z4zB)(ntvFWa%5?dM*1qqDP%WB)P2%7r5uWER#h#g6^(`@)NEQ+mb3|tCe#})*CNfZ zfnB?u<2Nxfagai+7C1dBgpF2nfe-WHUz1lMbuz};+Xyti1vtu06*@kg&)m?dN5d2C; z8-_kxHiUo|xItWF#Vy%bg>l*6?SRZTIRg>=6Sw}dLr3;<0d1WqZYJwYTtI(G8~7b; z?V-*Low|CSr=)<-o+j#vx_bM~k8GqW&Kl88$)El~M^ z&@DjP`o$8uo)#1XEH9fL#+e1Vf})fde}q-1WYl+4QLkDmMLg=5JA{sDvnzS?W8y5} zjJ(Wa6Rpl|bWGrcH53bz?P>=u3dE>Bk3>RZ5(&x{a%NGX+wDjk72r-zA|hpqq-Z}$ zr6dmR;e|rP0!QevMaLAvLC5IReN&(}z*m_|>bVPdH2(ZbB52|dxoISclS6B6(&CYd z!Np0;zi+f^CteHr6nlP~?XU^HAvd(=NxlNRT@Q$!5DpA98PR~G5IzuGT%ofH^2BPx z5T461xYWIUtG1%97f3!33^&nP^85vSd5K@-L|=5|Z#N6das%1Fdg5jL`YTwAyMYGV z5vu-WCb>(E~3YqXukzGk6fn z-Pht48}WO|md8!2Di0Q}@OIe^KKe(|A$e(wMU`OSovF9X%9jJkmNDCSsA2$IyAi^| zeSA`Ae_I@$|8+gmVg&!_E(dVI2wmmCdd$`~+A1A^{FtW>-yu#W-h6^e5676N+IBIY6P)ELT~!F01Dm;j8qr@jk_G0jAr_40b|o zbrt=a+*qv>EClCcg>YAH#jvGR?Wq7K(HEOivJkdDRsAI-6c{Vi=G@7*7QGV??zn5O zQ`5B?xj4M{++HZ0gG2V;r37a3Wau6xi?(+}I*)_DP>cwAsKP+-Gp5QNfFTI-(5HAm zb6=t>TvxK{yGobX#Yhwzv!+{cYOA5Ld;C3vSy2Dtj3#C*P?v9NBi)Ec(dqL z6?%Ibkgr*(n7h{)?rXGaqB{s7vB=IO-g~u!{R+7aVDLs~v<)#LG*$JUzj7dwXs9Sv zl1dHCn$gI!q2+D?{i|0n23N<%IAZuhwl9+pmo^zIW1d^0C6{NSdKl1$FF(O^Zk`qK zg}N7ck(V2o;q?rH=E|PKPm0Djy|XrQZU8*6o;GtI+oV>u>JbjsJV5`NkR>oF{})w^ zod2kh2D{~QTx#mdRw1}>XO=$F(eTX^+7;y`6s6shPd zm^Oh&zGiFohtuy(ft(E0#DY#jn(w~6X_2KGVBqJ{4d?o74%9m$w%H}BY7&XO@N5C+ zYjO0s>-UTrx!n`n`vIWOLg7P)rp z)l>RxG;?6ilZp+wlU!G$b)>qSKCv0lW=_<(&*oicb9!ohB^g{Ui1FO4DB>QjhY2O= z5AW=E32Xn&LmzU8*M4Wk3NU^~AiCk=N5u78CL#kuum*XIqF+<9g)nJaY0JW$vg6WD zx!m(!Sf&#>?!swM2~#v6IzKm}zS3aD;{ z$bymnEGZ2*YXW9&ff1KGd&bK&el+zBDOrAjrkl0o%x)bR-e9C<&}V?xkTvlf|FwE( zeFT48*CgMiO5Bh8kEK;3w6e?nq&2ZVEttc2p97Oyw$vX4&tglWxk4iujyOsDjb9T3 z{0gj7Vq2QpCByo#uWinAflk!P`rJ-XFPZT?UJum=bLluMWlxXykm;76e#qb0w+(p~ ztkb-~9f1cM43##0jK<}}ou!$Uh5t?L(vHE*=dG0yS!%oF@8FwqMGqTCeCh9=`!Gc7 z;j;ok^%$GgwCF;pa~c(Kd)x;nW{i4~llJo}5)HUamo**CHh;IXrRIAQjbNhj>R_CP z<`;tKBk+}b?AK9@JI&a&kt?{1u!*|01ZzwiLR0)bpYA3S5UsF>&W$|rjj;h~<(5z; zfPmcr26Emg<%I$vcj!;CuZIxsAquV;6NbdGYP9-FnlHkb*&1P&dIV=$@HOdjqA|A& z3_hWJ6aI$D7*|?2N9ks&`FbdDrdgUb7kPaWS$su3|?Z#zaT2(MF7-uh{} z9x6JYr9-P2;TR|X@lsK3 zZiqpveWsWhNn^)k4F6;&Ja>)V&8w|CrCWLL zjoe}PBRIf?N5m0W*80?B`|1?t33a_}&Q8Y> zmUM`MQ1^U44%q9@`TBK=7uV=4Uu~_jPUl(oVwEm) zlxdMoCa4QF5*K$dig?3(ERc8UN-M#DiRLH1Pl;nAm0Cf$Pm12EQiktkF=Uad#f~M# z(I6-#)wI{d_+HFWV^fbyy@!PSlyV_YL2n5ANQ}XB9U}-((O9zd%uwHGs{qev!SP28 zn_yF_l&@RRNGJJzYXEpF2X@nPmn58d`q{jfN+2MA-u5~RjEM|La-$`cA=*~jvUuNz zP>%+8TMEY^y+aa>SIDzZYAx3HlA)E_BC7H4mn~neCRCO`_S6E>Hsv&rq2ZzN`1sy@ zg#3=c)3*8{T?+aUcOb*&Dq@cjfXcyvz4RsiQF$N=cJ8|FZD%|$oPL*ZXNXJ0O;xRQ zlk7Qo`<2Z3%KL!9Ygh#0jHRh;+4z6?NTIRS`bO9wQ916%4Tv7+T;gioK!CBYRu8bM zlP}Dp!ML6&ZBj7>)LQU;#{Y%VQK_1G1gC+3OWKP_8(sD=UNE_}vNC2ZAbTNz8{U|0 z8-W5!HW1@tkE73qh5;D4kVBHKHAXLKp35Cid0m?~G0QI3p#kfgd|&TI>^(>+#*n`V z9U|{7Fnv=Gs%N*D_6oyOn<=>|X%gv5{7TMA9Z%TyekZSDGDG9QyZP9*V+V;(ZQ_>~ z&A=MAx)$&TLu5U91;~h@*2DLJ0nh53%cJv%Z-lol0*Hw6!CesdS(VYjA*c;5bi~pI zaUinwFL#=mdlfA2+1mx;rf>U4&$0|9D(wzM!XsOUEmAM>H%=QuVe?=;J;2S&yfJv(>=@LO?3$|3~Gn!iQ zEG_lPn4;#?x}2RG0^pKkDHO^|&cZLOVc%vpVotw{;-Da3;vgO~iRtg1(J=t0(YL`I zQ;wfwWqDBs9M}v!pMf>D@l81(>Y`=@`wAzf`-@LV$xP77t{JUuG!;9PP`zL+_gy)d zVuP30oHvR=j#11oMsJ@Dz?B5-)TBUkgPN8hCirYd4(q^rKSp)`+)6~XqY#t5GM4BC z35+6adWO&R9V8CxiYVX!=@Fq$BcNZzD!>-i!;c=XxPnLrpN9rZe_v4&Da>T!=rAFD z0%5VB8R{?R$A{GD9yH9JlrK>kVIor#Ge|R}x#tIXjQDW%ete`m2#zYmoT+@lnIJ43h;- zk@FYFP1n3oVyrE8{QN?U)XW)kPlmY6&!PmddOcx0*8<3?#d9Q00LvFY`5R1K5+^p_ z(1N7=VAHr&Vjnhy5=n{bH1_6FP!Y(*gPliC-Al5YpLAM0(en55`!qGgB!=zSy<2g z#zCW@PAC)+E4LV7q}uz?wxzC)`*Zw2cuEorTMk&XExM$Aj!LH!s{%yOmwSw&|D$_V3bzB?EbMWvw1UZO#e8PYzCvTVWheI~C(DWA(E^lH zL~;9svEHIsD{KkR;|;tkFm2N;R_Ow$(s*~zaT%9o9DlMjN#clSRhQiRyiX=O9}SkT ziIWMU%a){Wg`}AIpXODO7NR2wkQy6CW4NFpKNUem{{O}HrQU;}<&v|_QdP)yrq~Dx zfgj9L82DidF~#3QnlrA5gm}wiv`Hf(V4K%aQg|*2|4W;fnw;8I+e;!#=e^yrw0Ct|_RW-IBGBJitB@DQe&=l+Vl;b^mW)yf^%A>Unnlra^HY zzLJAwuEzm!LuM~i_*HSGwh!KhwSyXQ;l8P};YHGO-nWn0>uF4ggT)kmSm{mRuJm2` z^4mVp@bg5Rdq*3w2^x^@9MSzmaYwCBSc#quY?K|#Xf4-|=6M$>s^B?qED9ezY?iq1 zv^=@SR}Ld4@K0qSG?oMsci&xfNOGAxTZHLDtI)lt|^c*?_u&gK`fx zFS59A~ZJtN6twZqt9Lg4>8vU?yVGD0` ztq-a}OIp2IqWw|V#jL3hNXKPZ?s;iXb`4rK0T&sHFa+bU^2V}kxv5LPUt>TFE`xD^ zUW{)(k9UJ_;p)f7#y!2Etv~hWRnv-C`2ocw80uJ~bmsjClI%NZ z$rt-Wj8^IXbfpUI1hnkyw#L{@r`Q2#l#M=DzYryyR5OgsI#9l2r`)!46lKo5=*$6s z<;b8{cpTrAu!PNehF_K_oDajs;c#m}W!+g=a3f&F1#O_o)oQgD9^DY+(a3={u}U!- z%n1btJ+vrWxlzF3LcR{MoU1kp59!g};j2G|mD0P>9bv%cO4b6YJAB#8_eCQG1O{50 zk`kM5abVb0e8PC0r?+m+L;!Kf-`Lyv!L@4~Rz_JzIyiad zyaQ9(yzGg_mc$!MrO`7oZAqe@V-TaUTTi z4OQvMrp}RmxO*HFg5k655`*2mmfUBTQ^8WSut-Uph#JMF?)bQ@8ZLvX#)xA|q3dpK z7F3?gXEhSKm;v8;ysQr9-X`n#p7w&IFwpY`8UO)v@`Dc{Wx}`{D^fUgDu>uUv3ETEYP2zq~b$ z{>(=S)#5}cNx_0rHzgxP?emMuxe}RuKXXC%s4|ZyG3DC4zgJ1(-p)2 zOs-zuUpjHO;GtkCPIhrn#YdSZyoSJi2Anf*r8uP&bVm~ODPMKbJkfCKu#akpH3)3V z+h<1Pv-exFkhs$>(l?^-B5Bz9hF28FQCK%LVy6dJ65>a?$hc-9La(n@eb#zMX8>dn z8Doc6`cdFRH@D8>y6@H2jPx4oNl1|9qk^XScX{fbaxVsO!U-xuqKO~BAj0)4- zi~+O~MCdfU<&!*({{tWz+k!!rUP-|#@ewF4;x%oJ3H{}wh-_Yl@Nt<7f6ZkV5~kRG zZjFxCz|4rdp*JWSk4zEDar&FrOJzoR4bH>@y|wi7&$g>^knL!tNv`9x%{ce`)%yT2 zcCh90WF-RpdlRAbwz9sAacBM9$ZdyRpAa`)-1}cZj&u^7mSm zDjn+y_`o2lvFwqUq*Ygv&pfO9M;{N4vlG zN2TepY7~L6s#TF_lA4|D4+y9EL;PA>rzCBny)AzxO!PdK8sy(QPUrcr(F1% zDC|RHi|*AX|7JO8nKb+FAVlK^IsAEewz!F5x>RLB2MZ+`(j5Z(Eu%d?_t*s*Z zPKwfR|$D_fI?;GJ=F&QtcnlS!x8t2DNorkyo{fZE)CyaIBVZNkKgoRDOK1V zn24-LzS*h_QkoF_m;PN7mjgh9KJFXAy;-l;<$mNS#1oG#lVT|3E8v1}+fH7Hnzm}U z-8v-eO|-<~&)dZ-?acJc57#dPFPUGl6O89=K}v&#kggiRD^a`;x}w&T#fCjq+5?u; zJtprq67+tM+r>B?72lwnbNTSNUiq(F>WPt6gmc9(8H?*oCSYgVaU<~9N?taNlop{> z@GV|opxCP;6?sGOxCYPFgVE7tzB_*n_YwH3(CE-gkfDv3 zAkUt(+MhF&R5Q{W};P! za(ghsrnjC}o*P}r%>Ij4U~sq3>jG5^K?za=fo!Kmsf*xai@?zQjj6w%+@aEaQB*{Y zfMcj^FrzDik-!)vn>I z>Bgek5F5<`YS>-*3eYmL;D9~+F&!@j5$x z%|1%W^SP#~gAYGQTI&DGX04{sEH%md6!t#P=`%Yt`9z(cO7N*!O;R4em#IbwJb~9z zLY)p!s&xPbBqjF1KK=;LwyMaJ&~d2Eq?K*&=Ydldk-{dne`dM)8r^H7F>Z;^W8jSd zntyZnbpe(vdWHoXHm-=t_brwtpVT5K_6ii-d;^Q_yzle>)l{fWi##I%>5J&P3JnV- z!BJFLKFhZKM$k5Pq!4D#=tyU?Jpv>x3M0MqV~@~!@ji%z#>tYQ7P;Owb->->9TJbB zw=?Y`E5ZPx!oIJ0XGH}x)JzKBQ2C(-ycGX1O(^-8&zQ&~l*JeLGHVMH**m83R>FXBnQY9~(UTogPaLclzbkAZ`s-5lmE4p8=v1hn zGZ2vP%x@ZR?92wef^uc+sGL=!QpD{c@u>CqzUNyM>IuEznyid`HDpMSOJkoF&Qz>E zXb7jo3#^*>;J(;Lk8n?BT*UWs77{cFfwglj889jw zN9%n{r!!o^o&dT^C?w(4(`DRS4G>yOC|(gq zG?2nXL6bU;g}6C)N=5U7kmI2xR16)iDA8KX>6CtE*$A91>T4q}hjk#mjD z6)fU6?`O&%Y6SfL%iKdx%c~7_sUOgfVk^RNV0p2Zv!_Ji)VRij3WKMy6$|s%CF~r* zEDC;{2znBop1mLTQpe&sO=#0>V!E0LeUM~$eKPW+LA-k8t-&)C zuR;%(&(yEYyy>jsV^fz+CvJ;*oJ?*_VG{6b;R}jaMwT=wMzDGd_)v>G{yq zej2<}@NNB;5tPO-s+lZwpF*$yvpI|UI?Z2GPo3pl7PB>AM6Y} zEM9a0v0wHbvm=TxrtsA9m}UDabQtfBm@@LrT5jE_hs}`fDu4d!D#S z(&c!_^#*(sVJ!+a|5T6k@c=y?LB19k#RnvSthg?UL?bWfvK`1EpVUQPFl}r!Y(cLr z!;#NLF%Y?sx2Wp;>)QzFyuu8`R8-~eERun2WUmI8+PJIM1|5C5e0VvOTn8&I>sULt zR+AMgYae~uV*%1zSl}Qjlm0;<&)s~fyd4)tPSx&LuhrF4>|&66FO`w{b&1aeA__;W zHl*N6Wk_RjLVG(v`(PPSDVkK%!Qho~uQgUM0;SUMFV@| zm-d~g1?3Wy)r2aG@%lum)1{5Od#b4uWfhYE+XFf^iPUCfpYt+l$+#aZLiGlR_d&ES zcPP(4-h)RmR10EiA9$Py#Z+>OMFEMCaWHU-GB<;JLzNNr5`v)r?J|LoYQ^LUoUVKI z`?-mjy|tPyYFLQTE-jt0sJ*f0o!XM?9Wxp=r_ zRUsS|VHUngOV$x>4M;r$CklF?i%PF#PxFcCn z;5g0pKfkF)0I|kzzLhSe|zQt_RiSH4HG=7rYTPOe)Mz71)Oc_+LxuJdXTjzWer{4v;wJ z`p5*S)w^D#&6k4p2=F%6iE&6h35ItVciRn#Ul-@zOnX3+xuldJUwg<(v*avsr~@o- zle{UYIa?eAQ(6}_s8uE%VeDvY)E$dDTWGh{d$`dux%{P`we*`2ba?Pa72cxOlBQY8 z`gj|gA1GhyOHe5%Im<{#+;eGh`k(BcrBABS~q9}ZK z1&*d?bHOCeub>LU z^DMRHtfP#;^N7pE$?Qe#@joR*m@G&{-h(CFNG z;e_quHEnx8{xf`-Ijr#Uryy(uFG=+~&Lw6m7%Zo(-h2~kteO?` zTp3l-2ArG7^bCL;5mkd*nPar{M#bf?Bu;w2ovx&PwU2@jE8zrN$gf&Uqq1^;lUF5> zK*vVO-6?ctQ?G_>g||(W5;CKWboQ)?Y_MD6>;MYoCEVCNw3gThcbw-(Bd9YoXVgj> z2tn=)Y(FV(%3>8e)Pz-U9wnUuB_U%wy19zz%I-552A_xAi_TBPufD75A_GQH;oXXxRg63nH~hKgx(xb= z0mavm`%0c94?*!jlR&hRB?=lNyCkF`^mu;pY%FJ&s&pge>)F+R3EtUC=lBR>O?TCQx&Qja zq3&C$GpMraiqCsMoIj@1c@Y-*M``}<5{3?USz^*tObB%6Z#Tq?z5Q6qCSdec9svsq zsIdYYo1+T<3+EE0oOY3;&z!LO&|@8;qg2te#;qJlz51gvUqdP@DL^Lw@hb=FRIj+4 zSx=Merp_&)J+}n0J3o%{AOcPCxWTHu_AehC6YL;1EA@AbM%K`RU0JuBNYzNg|IIHp zcwO}=R4xvna(RP=5L@lg&5OxYFM%EHal88ZOD8QTK)*Pkz%S~}7JN)n7Xx5Q%7xH( zf}L4-U!2Pir4L(su_8HGT290nz~J#BT~ag28O zl(1;X=KwNQvu%dqR*;>#&-lY(56X`hd$5ejPxNwq6Z2)P!goKeq|?sfmYdRo$F8fb zB$*U&E+!{eoX&GOrer!FZ_|x*BE;h;xsO%%?~UcX7Oy*xC|3Tm_81l26z=Z80N&&QFWW%wE*loo)YwGK;`QobaOP z;|=H!TL&zXhN_S8?j*CJVHi>d(^^9d$z<8tjP+QF_)j053ZDs7S$TEXkr@{@2 zK*fn@_xk8Pd$D_^9x!Sq3Vle&7bGc1d?)H$4vOI=O+<4(D5GHV^B5>pD-0C4h{hm* zczG%9km+OIT#H@!e!A)!RqiifB7!IC2hZ2SF9izBBR}fq=~8Vg&I-8-`D>r7-S;~dDR=-JCcX(P4VbB!a5D{t5yN4DZL{8hmcHl93 zn+aPhzg)dYa$iK-e?tSRa6r4Gyj8;CD9g1G67mQ`+sHs@=XYB*280`ocYNOVvJc9?lz3c)kVX_X}BIj zM-A*xd6- zo26+~{(oxeWfvFZe?hp8F4jWB4G!iA{$J4k69Cw7r=lW7~!3o7rAmD4a!Z|~U zGp##(o`3OTia4oW(ek7iVcadON?uS6US|Q4QEtn(kSMSUZIz@Mu5xLVU(Q0N3vz@5<-177wQ^uto(N)!> z4FhJ~YP+eKtEL}>U)rtv3}YysGYH7$dT(aif|09796PLDC<(&cX+uxW*Ek9GK}z!! zIMEPoXln<0Q0omnQ7fO7P1z3o1t5}=tnfnSrD_XHA-%w7(V||_K-5z-U&1TO^cDwi z%oO=|e#l>c>om8MgF|!ke;nyNpEm5b+-C0;4auZ+g4E_}scSOt!pS2>?|oCE6RbuRzGe&b3iBss6i&)4 zL<;J?!ZiEjFG>njSlW6hxWhY+ihDuPyRdh%PE&%Mdia)!0_a-YYlgHqkufh_>cR!P zYEWzlD};7|H7!}LFobDgPQ~)uJu&v*B}LvU0L{|pL9=fLfDhlsNW3f`uPdZs<@4(a zhOO??2T;)i2Lnm7mm7^gwh_$2;)_BCqR<|f3Jjn=@UTsPZkYL9?cS_BOQnv;9Irh} zd7rB6?hdl}tm9NBQG1J2X!PumiFx7II6DM)yU7Pikm67K4C4~Ca;sKMQjxP zc2HNYG}XwK9xa`PzHFwScRTQETjui$T2NMTiFLS7ljxg*S@+|<4T3WY;#MAmdAH|? zm|WASyX<;gXqm@cu9oWDN_jM4oE6|J7o9Zcv;ZNRTZB(w@;~hF{E~`$(5>g>Bw9mh z9YD_l&eHC!s4)=i6Uyz>3bS2aNE&lxx|*{_|27@oUOz5UAC_J>BejO5=JR~HvU|}2qp9t)NI-|y?v|EteH4(TiXdiQ&54(zN z0R0KNnzzm&S`=+H59~iR7PCbVp^m?25=-9rPWuEfXsR@#xZ>`6uN(zqA7&+qj#0?^ zYo(X0s_>g1wDepMCu1=;{@<1PW)l(&6Dod18Uht?s*X_Zdep&S9K7?HT-h*f7Eh)p zl!!M=%}td7vQy0~9~IhuH1#%;K4iWwUZ;rX4;N&yUKvQ1tVL(!M98|Ww_q_a%bjaX zdnva7$>KAg?oE;=QcIEsoB8LKWr;IIQ$88m!+iubfDsAa_D9=7L9Wo7jv0F^=d7L5 z+YO^aemJRnxFK<2i?pX<$>DS=*$l6}90uB8o}y< zti5Otrv@7Se`O1H++b90ss2!%Xw$E$@l3&^@GnxI{>590MXBk&#Q<4->|KAZ`Q8y5 z1CT>=_!~URJczXfDKHf>JxxX184YPTa-GWNf5 zOG6FFA4p7+KhtBZDkiGL=g|Oo1c?B;$4geA0h-_qvh+U_c(k6CC_Kx8xvc zKpAR>Z?EnH>PZskLm-CT(gNTK6!$6N*r%rWa@C!k>IR1Jf&G<6Wfbew%j!^i zq(zgg@JT}O&p-(u99i;}?8g5k*D4S;i+M#tG}W+*^D}byQ#RfR5^DuOuGp*B9r!>s z_G{P(s8pQAaZdemF(GFZzhlF2V0STU4Jg!_CFZu(@oD2J+N-Ypts{^%Z{@a>ZNk;Z zsmaHk91S!7oTC}&n4^=bcbv9a?Q1-GUCc1YRnsJq5Xr|VWF!cs1$Mgg&7COHjHS~d zDMut+aj7G0J|9k6L&*ic<1xdLPCcbq@f`@D=41)v?P2+h*%$SQkc)0OutM#RWM~zB zXW;kx9EOaNt9!7-CmB^+;IabZ6>8sPFLvQuy47LWhfnX!=^w(FH=C2f@%8|SpWk_D z8_zkSRCq{TQ6736!4bhkf3HN~U`ax!`DUHTE&Y_uo+-OS2*+38n(l8G_UzB(tt0@l zZY;T@l@m$F@d}W&5px)_>)QGmNWS+4=ay7lFj|ZORa=dP-Jn^Ys}G>ztKd8*VQ4qyk5eHXx{Bz3-X&N~Ci47PTpnod9u$<8 zX0kKqPA7I-&zs&rhEuX+;Cb8k#nbrvau;RCtNP#a1N_=Uq`42(OZEn~7sbAih>rYV zV(Q%pHl2aoc${KXC^SE>@!)otOc{)%d@@uN*q{BViKJq2F z@i}K`rSk$;60BFi9Tts-#U|#kxS)`feFTJEvOw|-hj3?)el#V$h5w6#CxMOs$oap= z08^AD@*MS!Nxd{t*m^aEreDFtwiqCDtl)Qngg0v|m4IdBKdSZcKwcL| z5)-50cUd)QvS{8%C)+^duR&dtHQUwvl3en;D#d(mXr!aPHlO!0}m0N!B2W$Kq@llXpbNbTD)C$lvopcM>!Fj-RO; z?jpq9o)*oO?2yU(sc8Ik(O~;AVzAQL#xfNAcvqg5QpJ39f9yLnM7IOb#~wjj2B~g$ zz7;<=iun3aJa;KtiTFb#Y~zOFQ~p4M@G|)z`;oLRj^zRRFplQ_&3^A1Q8L2mrD zj@hiuNd3^k7OTFT4Sxs}I;G{LT8k}lhpfl<3q$dlx#dyWUd2~o;43rn+FK3{Y+{J~ zN^eoO`Iqw~FiICO^1dZr#^abXD-IcjZz!^e+qpg5AQqU*@vE127J8wR8Y9K+C_FaIYe4VN9*T23o(?`IPnly8v<3 zi8#=>A^5g!7K<-*n@gbSCEJBx!XZZwK*#63J_8>(*a3&E$^#xh8Hw!C=O^}UJi=XK z#riQB**Or_`h3rak^9=mEBB&L>5YOQxE$d2T_P)hn+o~!`?E%(j&DBp)M1SFve9~7 z_d9|0ToZPgN;8nq(65JlVVe6Hu;gR!lT>Kv;FVgOw1}|U|7MQaBaMEEM-y`Bq*B<^ z9SW{8&I8;gadux(fV3H&8cp50Fz(%ti@LNm}aq|d-Q+}+!h2ib=@<@f0 zI-x?5Px75=SBeCC{?NrS*8$+^0>I<&-JkCQCjMHO{K_537P@l*42^ zfj=ltct?g*NwxIyo;dHi;2iMG$tJ0>CcpPG!j-d5mov8kP~El4HHL8QXDm;h?F-wb zWQ6E^Rq?~b({Z&v=^a)7`~T)w7Ftnoy&*z~js`0DG$df6zmGp;N%m-SCtdf8}WN*()R z5ji^prYL5Pu!ue-P3j*g$qJJljtyR50y;+~y&O`J;5bP%wg@Uw@dq4NBC6HZ4I#yM z)C!jW!1%~k;V^Y@Ap+12C&V-Ns20j<4N`3hlKTQ1Exg0vbB9#uMjsT@5x7dyAY~JY zXR6RA90B2Zm-eiU34H{7F+=J;yWBi9^g!b2E|5PNzVtf?R192>>t9z3aswZ%9G>@Z zV1;rK%a8L7HFHvpCYxzNl$WZlL1o9});sIlbs)$jycy`G)ieM%`UJPibH_n-N4$9E zIl>AaRD0lDh{1TW%ViDz z=pfH?KJZc z$|ln`Z7A%}pFs-XTn65%cw-kp1|)xuO;LU!YDWA-MTT8wX@yc&14`A;{YIVS z%T`Xf=3li~T_+>bLdu>4JdG51MbJGkR|cJ(|A$+Flz%IH(?8PJg96{_wZgqWm}qdm{NGTU7A12n}Ayixs{wNG5^lkzl#9 zCk7Dnlvi$uU9uh<)+mROLtFe(h^YL?M69ivN%928ojszxIBq(RE(w;iO?g2pR&G*c}h_F@$%Q+1MKNHPbJjxXn zS>Z(-lkS(2ghsj(oTsf|$xroL+L~bEv6%8xf6|2>jlMfLxpRcnz3Gv@Pdp*{23!<2 z5MF3PoyCC_1K2MEI%p(qZL365(g3qafa3YQu1ANoE>gf;dQR`XV^>n=URc!D9+SB{ z9cdvR7$l)Mvs7)@$3xW!oQAZ;*F$^F4vNSTwTA9f>AIJM<#yt2!3n23%encL&RjGa zhBZU%P3liYdeU6roYIY{oah!rgavlNEKG*-ptg+h3aH-7_a3H3X)HZUSwxzPQHzd} z1Sn%CD-gLWsDqayOg<=@WWs2rObYWR~=@pgPS% zKaNBSc1fqbSpl2hKQO69Rz^e>S#~`RwJd3?`}_A{rD3yxjM#r0$_oKcHi9{8y!MM_ zgB4jOOO6^!!1P?Sexa0Z7 zJX2B|%H~niK4mm~PRjz6pi((*pfo_{9|zEX1`@?{YHJq?@CRZ|;-36O26;k3mf7`) z#5jKOIr#5JO-)K?Yh*UvpgSRp_{tT79BP2Sx zl=aNVcls&FsmhMUF2-5YCCk=WLbjNi(-F2b5qs_5uyv`**84VT70rSdV67q|r6BZuTk$zV<)cWf`w2LCmdyBok&UeWUUQOqg9MMhQ7;e`}#PjwXfn0A$zC1fqimv%Z)QwNq0Fu!!DDlo)u`occJW59>z$E#Yw!r!b;+PL=oahvoW z{T{hC$@HN8QRlo0uT5MJeH`EoQk-#hq)Lzjc{8?iEdhpUOI*Mlk;IR{x59>3DM%w& zCstw%WO?-$bS#Le-$eJ-EQaE*4mX*=ay|ikybu@hFi2-twF^PR_vfVAZ7xk;7)`U! zY!}TXGtDWK2uyls<>8Hq5A+$o?#vVP&I-h{aY*BCVF1!+@7F~Ym&g}72$DlQhp}}AQ$174F}7dhWRT$CSnzN#m4hSR2RSP zJwTrdS8ZTJIAcgET0&Q($=kSl&`dx|f47*P4wKM9&_X&V>}-psxrOH)zkDS5^Wosi zT$u)Yyg6ZEJlM4i<(j|{zhYNj_WKFAW5QB21QUx|0SfQaQFfGVAY>@4cuyLUJn@Lj zU0*O1DMndz2V&<9$F!aJHziN872^W6xmO);#bC^(@{Af>+qlD%nM-t`(hgt7oGS(X zg>nwbuGO#!;k5`JlY|u!_MVX<=)uB~qftOFQfT$Oq z;IGhkf?ek14^?eI$y*F_=#)mEdQN)x7*Swg;0tE})_qzWTBR6_yvHYCOJxPf&k~U~ zCXxrkbpHY`*A7$NjLVKmJyURRB)b|e;s&*EJ*aM2Jr~^oH0p-oT~MVmK))vIWX$Uq z0htBYqmLWM7<7tx1TCR97wGzW+OVe(6cjcwWLR8_WGXVl0fY&&ZRd3t#EX>T=T)MW z%r@UQ1R>S=VmD>0afCvv6do?y_2Iy;74--Ewe_bj9R{OD_eSW5QdOp`L%pQkU(HH; zr`35wJ`Y!$cAxVHOShhNTUAV=%zwi&3Y@1dW%csZiLHe}^xiEAqJ} z-Xs)p=<1da@Z_nLLql~pkpRWx@qCj$tNQFKWD_s+;=Vj;_o`KL5+)uTi;t?NmKOZm zXX;|`Ee}0D2r};h{-T>;-cXgxVO`LNsXrZ4sqp6e>;Sl!tvJC1z&j!fKrx?v>RjYR z1<}@t3T~S)rusB;RPQq;0{XX4)g~yC*Nss|{m#PcVm|L;DP}wQ+F`aM$ar|CQbi{H zbpg%dYHxO4y5aY1TeK(R47@dIu;70b1i`(@HYVams!FDZ9?r=g+cMA?+-Uct(9E@xeh+>XhjJ1##jL@ynRA~e3}X3u`Bt-k zE1mis%wp|Yhn2cxv|%os<5vQnl!-DbYv&j}cAp@?S6TQ%0L|zC5sr^ay648ugHkz9 zo9li>WQi2#$UC-Pg1<7fRj|9>ulUhnR!eh^+a-V8_tfK;&b}mf>=pn5700#ohD|5qS7$fh}vM_LlcFoE@jNj1KpN!}S#tzxX zys6H7x{czkS-O=Gb7HiV3CtZgV*FO@#xm=FaN!xsSVpr1<#J(H33bN&ya&00c*LLc z{+}jj8hT$*>aSqRZ3@z_P}h?+SXQ}4K<09?yYmJEIjc> zceks_ZXZGPG!XY&cuNTzFs4+JmL&_S+MGA3Dr&zB z;{qts=B#h7i?7NZUFlJ&o9{ukrk(-|V}w!zPDu^)L?I_7@_H5v8trs`<{Ql|IUsl2 zDldN9FVF)ojx?M1r|!nX+<&9z&_MiSKMQ6n*2IvOOxVQwncvrKqgF7G^pOq4MDLGB zbx9UVY2`P>2PQ%7PsV|H5C!!%e!W+JG`y7zw~3v~!N+TCaf}ujeMs7z{l`awL9K~Z zh9D55q&b^el6@TBf>>tdjIHYSKGel+%dv*fknO}|hc*)rQ!p?e#*Hby&mJ-4$6v1X zPmiE1-cJ+~o#dq*=sX%IYFwa7trXroF>dJictqaxK+T;(YcEu(7^9W>Hai+pZvNI1 z$>9<|0MmxCU1RsA5lO_Be}TH*nLW1eTD`+au`cAlNgcW568FhygdSLIx}3HHUMHWY z_=x*RY8DUJ*TE9X@1`)@&D#rD^dSSDOEfyRNvs3ulZ7NaDUBiqzY(RMc6xiu4y%gA zkYt9NBh2Jworup6edV7L;s`fBpt8^NDKi_8DCCdd2OjPLkPjFrtUcUi7Y`{Wp8k~&<;$M2J`}j^w98tcCaFe^%~9KZORY`Eiht|x zcGTkp5jo*nmrDeXLMR67nJsAN2la)d_q3a+Auyy9-VBz-ygXYbtFB|CWxYy^9gjhx zUk|)geogsGdXod+M3^pvNi|PP&Dcl_9WmMujJ^j}X8D{1LYi*#k-t4*ix#Q0#|Z{a z;+|cHK|~8vd=s2Zi=13RyTO>mlcFi;lSGL*2I1fp+N?YE1bCK0muDA~0JT3e#AE>7 zZixX1G+o*!*)j1Uw)Il>WOH=SgCO5PB{xz_d4$OYcDg@GdnW9!g1_Mx4aakG|2t?l0wqD@tWrti! z)$Vw8MpJ$@mkfusDM~XMKY64D+8%t~%_Vj8XqUJZT3wL`YQ3WgrrirY!F!P-aRu$* z#1xq2SB3N&FgORr;rm5rS0u!1ZRC2Gyg(ESqmu~@R4q7A5_-Ao0n?iN z>;J|)jIi`LMXHGWk{`n@3FzD{E$96RiF(saw0w#SBFd9@dtpjJ%p^2iwIDk9be>mc zF=1#p-0KX~MC^F$4!M`%RM~+H($B65Suu_L%m&;l*Z!QPv94E9I`$cWHt<_2uXX`)R(IXJ>mnB}B z&{*g^1S7?7y<^ZFcx69eP8_Ch|PCO{8l?+|G}Ih>HM=L%~9tAb_pcf%493e=x^ z*hiLUA|G+zs`~aWr&1oxY}bxlKr+Okt9hOu&3wM*_l2x_oVF?Ij2`Qm?C75nPj4;( zRaF)1dgv9~*WF`JFO`nTrCndLpjZwl%)ofySg-o1UpA>n!)R~OQ;e;{4!$b zm{&DoE}ag*IHA-p{NOO26=9br<%*3WS%%tr2v+%R>caDWYz}Q>+;lnM zwCPNGaog57&7zrh&ff>f>>W|utzY2@NuREQGRTL{xNDyK)6ljjeiQsDgg65 zqa0a(v1uv3Uri-d=cqauG1zoRp^UOXCfioN<|}CJ_ENP&6x%sd`%iC>RU2IMyI2|8 zV4yll0ydgR7fMUL_q_PI0hfZyh2d;wTO^gSC_R#toM{WXA$yllk91?!;-Uf zJ7UgC18RsU96&M26}6LOFiU_8n7zc?Sk;I+CP=e3+dAs4t7gf}o<>B+CtgS)-|m+o zl0LBDy{8XJ787%&q=#7~^{j!Vr9Wnphc63)7g+>W(} zkse0X8uVM1sWPL8SsoNt%Tb@L)@E(uG(8~*<+%>5G#W%^kPz~M4>L=DqU`2>iTgN) z5HrSubO;vc6jf}S;dz9SIiSv+Lri|~HcjLh#3LhdAr`u^XVDprsp2{sDS}M`ij$|< zfd7{@#O>JT8FDwCLEHGx#-zTi#>8?I3m~8HTdG|L$!j$#EDOO}w*TBMKHGlFyL?H$ zvugzVjsXU#PFm~ScX#0Ir_<^V916N)fom~~0N!r=p|BFS)yGNb!M~cx)rH7+4oa+n zHF~J-UQKpX4HHVpbhL2hZlq*&`zwL<#g>e0^JN6NTIG4K4X3$KpH->2~Juq~I5lPXdrMG-B7S)=@EDy!H*thLZUFY96ipoY6t)u(-&m$tFnZ$kMG1#Dv`9n!srIf}Z*3YAMa# z#SbRkqhuuc5spC>9VjA+R0p0`2ppB;lw|%Y3 z-6s5V$N5+p#(}#6c7CA2hH%d5k=!tbehKIZCNI?H>!)VvI>rV?KdqZuyGLmN3)L{@Yw*(mMU!|USt^DjLmc~yx9e$zmtZ6Z*LMg zEy9V!-mRvAO7Js_^3+rJw|6g-)7sWL`Q#dgnsJJGqjTk7)PLSXNmag@=kqDmd1;|~wKD-`IZm?m zdvVfi&-YEn6ec!B!#CBnXx;=}32fg8lg$cjZjc1^z_`6dxkl~L)BW%Gg1MYG;#CNk zBH4n3vER!6uw6*O^%>)3+r~-54ob(K^g>bVi*jn&w_ydpd5mv3U&%DglvTLRC-gFU zp=oNcDH?C?y^S3LTyW>dWt9lc!n%uZltmEpD~ja@%Lc#zx~yg~h@(^6ADX1Jw|=k! zL?XSt)tQ%;23A~P_iO2s-BNe^P>kz0`&oYvLl&p4BICJjs!%oO%11vS$mNgE2$pkw zy0{0skY|~WPJD{oBZ#4aEl#seTeX&B&uOfUO_DbiVTh^+ej^0m8pD$JTo>5z3K)MR ziY{Gq`|d*{&W@Z_;E_z|7VmcefDlL|7}?kvdKue_$lSlUtn_xF8RpmVjjg508<>>C z$R-Y5pi-JJmT`{IJ9`<&BT2KB9)NCoN5xrbC5BG0Nu1RK_#TM#8T)lO^{4?E%}kYM zb(w^=L;^orL-eQRUQODdxs?~5ts18#QmE?BSJ+@&HYu->H^oJ7ANNfO5Wc1I;ge?m zwT?uiJEzEacY|<@;yF$gu&wMhCAaCtros&ToD3bRxGMz&#jh_}Cvqjl691gqV9OHp zi!czhPucJh0PJfenle51nCO!M6IX8wlm!E+bH_2$#kRsM0K(wT1L)#3nENRx5HuJ} zFare4jGL*qUG~FCkd{_gh3sJ>v`tHTjkzE|_1!uA585T^cCtsrtToO;*>wd7_BdU0 zq(kbz9Q2Y}#aY9*Y~FBDBl>Ae`%$ki{NRG#-t96*8U`rZ)GLK4dqUKOsc{iO8Inq{ zNelBnk?vNL62}Ho50yy(vUz`eZMk1+k5o+%FzpAlf0C3p>j^yx7R?c z1S({S^%#L%piNXTPA%FL4g3GOCfx?N|DWmkIdjDtOFq(#{?KY&&T-X^(yqMRG&cS= zxf^t)oA+mL2eXVY3g%-|D~^r_xO3Q~u5Du$EQS%)S@eg}xB#8V=i|r9b|V)Iq<=lh zs99)lfn2Y2MteDlBm|kYoFb&&=O|rl97H?85EBc zB1KFF|94O!w7_Ny{%KVRc&K)L+_)u8y@;_xCAjiOXeWIs+hmMW#%(&W$%0mFt&*L0 zraKqaDt^6A;wo9uo00V)`5^_%0}82%1GVM|c+HM}r%}4RrumtDaWwOdhv$eZCiuvG z%4!WSYuRM2yEVqCCwgG01m=5T>YQ=l+T;;gB!$B=BAp$WVUH+ov#^!D;|rIXL@ut+ zJziFqmT^sLM==X+;%LcAGf;a`o?x*=T=$`IrNuywL2vO_ThURNm~_1sCOd6={3ZoE zN(Zt9Imkx?sNNs3(S61GaXP*@%SQsGD?qYb>>|M3B^mIVBnd+*xH;XA8G&4zm6E0{ zj%-My*ULF-Iv#g!w^t+!B4R>hE%-*YV!p7^Q9RY)_RhkhXVRf3u~+|3<|+}n#M70| z<3F3%kU%rU>F_KDbe(#goPi;&*~u_S!^4K)^6c`nvm<}Wl^$B)A zls?RA=03(>e`W%{WbkbpIrynsqqWW}~G*ye`zQn*Ke37fKEq46sBO*#=_i_Q>wZ%Mx>G$;l)K}sfE(cno_aK$b3 z+Ur>9Z0vC^w*A>Ctko=pwNjYUz4m>zfh75poH#q5I+pX!N_{EdECTEII ziZJv9h|Fg!U4<6c=8RJR2#<MccUIcN98(=9rc}k48-^+lVx&*}n|6$ee*j+bgn}qG_(#e~H_et`DPOZiWOI-n9(3;W0nGkecEz>4U^!oR=R=Kj$zNct2n!hY zXIcZ$wqycy*v9}aVpZ31{i;Eh)nuy;bs_v&{Oas;CCSGVhAY)F2zYdQ(NC}aY+X*? zgoWHjRC_-Q-s;pZnYN-2H&S)WRwB?|x)1C)32w=6^#YZ@xO=1t7U?Cof)Fsa_(;vW zf^}nnTDS4Irf$!0LmTkzK&u^Ag^`cHJ=c_g$I2|61ox88_sy$#D zo=`V-x@a|gYBL;^o#J-zu=yN<*G)<~)5joRgH|r~7}*a1yVTNx2>Va?jslJhjY@Wl)cHeoXby-d38WPC%?)M^ zhRQ-Py=K>hn_#vIrmGOIcM@spNmc=n4_vmudefsW)<*J7E*}}HyD7YLzI{J;wdK0U z!X|1p?+S>0+Qlw+c#DdmfzA^puA*R?Fld!AF**NvXcxzL&Z$naQN-?Bu<;A7Sbsk% z+GVZoD!A6W}V^I7q$jG5Y*%~4^s-RU#KaOZnrci5H14|^QLk9Lnx=A z7AwcZ!&p*|Eo?gWy`xVmD%FC+&n{w`obuVqkr|ra+UF1$En3BwGzAs_cU#lk{)Sk6 zL2Qu=JpCz_2FWSq>D~HYm486EpwL?s`jLcw%@>(JjThJ@CWSXSqI$BdgDhQzpM7|L zTJmBz1zg2U%C5DZHB};q=)7)R7Ky1%cEPISsNv9=E6UO#M83xTrAvesQ@%~yQ`YOA zeWTAOEr$50^@-@HnsZJ zvycsD>damX1bqQY{k)iA#?+}RuB0Vb)j5Lwwg;RR73q~3W& zq-&vLw-W(4gdA9M=gZx~V`zcr^&$^fD2R3_WU z7cSC$soe%gNjwzGm# zXZeOLr*#KFb%2Zz*Z}Vd${+k~j1-(bA6n8PHEVfug!C1UU{8!Bbo<;uFzto+0p*W2g}vf}MDvqU(m~H6s1R zGLw}WuVM+q(*u@!wG^m|gx#Rz8l|KH)zMqF<(kB^NxMajI|WB(j44LK`<=3tu8G~}P7*es@q4)7T1_gK!xFXw8)i>L5+(m=ow4L`O0N(E0>TI;&3(D&A9449~ni z8Ch^Ze0^5LeAA`uarUtyKQJ@;>rK?n9DEQKvVb7sjeYK9h@Fu5(@rKJ*>pGVP`JrM zHO)6J`b^jI$z?D6>NVb@lMEjULuIJgV19^i6qU z;X9UX{N--U``7^W0`0GNckF~Cc7x~sbTh=Cnm??2n-1zstR@nv@S=n6*f)ldGQ@G< zdl#`@DcrtDj09e*#;OQ^?W@M51e!th&pAlF!S0!FAzusWc2pYqsIGuy#RC7%=u#S| za!Mk_Z6MZve}5yg%de&-9V;@~Wy=d-B8Z2~+;g&@+X`W&=jFz%ZH+1jFWI_s=O$|z z%v9UNg*M;F9wv23RQjcQ2*$LppMIStywUe)tS%>gMn*uwlL1J-+>Z(fIvsh7FQxY^ zf8C3r6)P)y)dXkmvGhOVm>PJAT2H`;;Aa;_CiE8@QHmA(L*s!lPi2G(j5wPWOM^rv6rn-u!E3Jx`>-7VXWT= z{W`yFGI#FC&gNFck<*G!Rqs(a)mIZ8!Lc{CC>*B%apbNj6NV_Zj)R$`a;8%dzF#Ai zj6z8*a1s{@DyK8xPe0uIxtIb1<>&#GNk+hB#l==u=P)~NE~0`8P^W1)TcVZQ5gTNC zWgbX>BQUY!;Gz2?a4WRF5#P5YU1G89mThAb2@B!BSvPrCV=jhxcMCNoiU7sDkuW)g zbD^K$4lO{fLr zBbERmx&-WE&9`+N(Pjm+I}2jL?KmCjythPp*vgKDv(23LVpoNz9QF;0YuN8>o}>H$ znouDfr6z^1XZ~X17#Czag{)!ar6A!1J;RluZ@^FC!X!Dlsj6Vt<4P;|YZe4S8sRo* zYG^+)vW+B^1Dx`q!Lf&h{i={b1Yl$;OycMvCesGlz9wq-Uq-3Xk<}hhC?+k>$p{L% zPTA7UnI~}7N8QW4%53N^7;wJK)B&ez@T}Lso8}mY2MOjimpQAH9ynhxqR5<<>sJJ* zchAxBkUdwL9Y^r%G~$fY0A6w)+pwgoYR)cbR2dAjtE%%_Yiby3DM-8rt}^e!J8fvnT0~!k2Q=pY8JPe*M0{rdij}lYg7)69hPMhIt9B2sV#0QCh-2YIQ!1YTM*y>3!sa&2RmiHB9pW8w@5N$xwW zN2IAjcSB^=-isE%onmb;F9je>l=XT{i0ys!ocDHVicmV%PK-eqnTc2$9@{1tT%zYs zKwK$e+KB`KFxF-Ak~Vwf>+N(E!;77t*va@wGtcAnL9iAwge5GlALbL1NbIiX-xORi zX&P41Gvwg&MqQ*R zg%a4=L#}N+oER?AUS_`s8|^wP^7spK7o{?6oAV~YKwtpfc(XH9fn=-?te33zUv(96 zLQL+iV?$Ix(#DCENuIHo+Wa{$Gd%mn<@IBiN-DP7?l~~Q&MMRBLN#uX+`g@_?D}y> z_AVtto^beCVf>oMv_W<{1G;6OIc7O_4(nEy{^MG(K&Sm8o)C;5s2nDCA!>3vRp2|*JF&lW)y$g8gJy*W5LlhLQwS>4$5gbK^RJqM`jXTsUYuaH_AWm^!pN=1p1Wi zT0|n;1cNv^H+o|JtI}?CYua|(5Uo(vu+T0ket8|}3 z#$Bda)!jNTyzSh<6+E_g!Km!!!ZYAK8c$e9P3X?8A#gUKTD53*zo`*$;*Tjn9pP^g zowrW&(@ND(&GKpJRmk4x*oguIvj7Qe!*{A|2`7C6HacxGD|N86zwqxj!1>Mf>koqV z$(CviW#o_iF@nD*{$F>7#@gGZjfAa(qQDvqRMmIS7-@d?ocs!9AFk4`s*JEtSH)Gk zpMM_(pllIW9TLiTj?xNa^;mw3deWCbGc&Yf&oS~j!Ie}=q}X0l0Ps3|Mg^%DT#V1z z(TK-Ef{J_zU$T4pc?>Vy(@?RsOwjJj(m)yWD2~ZkZGpniQiI_h@ZmI=YGcrXMGf8b z8P4Rzlb4q$X@y^n+OxTctrN?K;HBjH7HuOyC>_1epGn00D&RO$PA|JLw#$?Jp;Dw! z0daqmx?-IRIc$&=-ef6D5{^@isUQ#}8)i6C=O8>DKowG{3iXVqp@ldRG(W!8O_2RQ z{zvQ|{b!2~qjYEd0G+SXkcgyv7$V#SYd}&g3h?)yn0kFxj`!hR5n zFas-3`xxG2&H(|YTMga7iuu{QiXd8c47xeV7)ABmKsTnGa(%M?lVxi6Ti-fHGb}_D zM+hCL^RaWzf;aiZ^EX?n07-t+&zqCEx#X4X_%A8}`16OLCd6ZIw=2!?B!o@T#rqbD z_%?uuOU*Is)ulT~Vp=fprM^SESDC@3`xQwKlm=nl@~6gx3_9su)=jEtG(N5!LFhZ* z(H1%AjBMTBIkkW6&K0{0ft|(axKjq&^dH_b#Dx@eqttEFYj{Fk@4O%*wR&Zp7}h*1 z)}gQf7w!<%&5Xu0A&R~0+7?6GjQ>pU)LFhW=RJCi`%nBm8FcMa@Z|OA0T+zf>ZkGf z4k9eti!SCZ{dkPJ-%vpWXozzk%c=D;eN0f_f0*cqWObpVgb}|F(B2I%d8+W%IqM%LD3IJ|o*fhGbiLuWB6arBf#)TLwpHp%&8FKa11gv+{`->=UbF3d_GqNhK;-N1 z(rjS_`1@3^2&DA0=RY|g~y{Yy&?ji^#MWP>QU$&xzFMqlZ^ZL_MR&4vv0MU z-Ajup(X!t;{p>5DJw%G*R#NsR8U8BJm*O(hV{G`*d@_!JSU-o?`RS(3!w`d69CHd-g60{D&j>j=~o2LXTO+Mw-lW2w>pGZd2;vd_*hiO(w%9s_tea z8{K8q-JZD2{tGZOPtfPBchc<2eYIf*YDS3QrmU{0VvdN#HmN4=krN|?T^yZ_(Uqge zMsjN9-l&%SJXCTcH~k|bs$cDle?F<62Ik@&3bWj@0e3-KskDd7yf}09DXUBIYpX3R z;lv;KBHo>gog23ZHAT*<=h5k}j+5M?XwfmOUxT!sM2I%k7WqrYcW}|r{`&y0Y*Xgz zt4|#s1(1{FQ5TrN7;LSv;Q!xB>KjH^|4NN%k3;|kfL5`d>9!U*#lqPG@HB9O$&a&! zqN6D8uCU=PAQOnx6=8FRemw#0;eP@QudaA5Fmg?8?ya>L#tLU@djTr>YVmVrStgsI zyiEi_-^ux2;bszGpIySA5bif6oGDtjw)wNQ^wbx-$V;QVZj-j(%Dn_DrI&M&m6*r1 z&|7mh5Ecv-weu~xqnt8Vrl!a{YAB-YhZ7+(A;U~So5Wu0TqW06fpeC`&<{ zC1Sy^&CwS^yr4|1v>Q3#Q$pMZItx4e;5Rq;0AOBI!3^M#>AVIts(!BNPFYrKNtCWI zBPb}DEzi^kY#kv%Rt()@*>1Q zN(HMXU?rG<_Z6PK{V4Vom1;9qoh10Y=Gd%2>1?p;ojOB!(9vQ)SI)q`Eg1arfI~{I zZ6cu~s+Ss!vFQL01QxJaM9~w44+OT;;=oz(kycL%@#};4_x3XZOL6C%V=)y@L#lcHi2}Wm z%6;$BD1bqin4Z0NU$^vJ8QD1*3)*OzXE6i|b55*_;59p|X-Lz6bnT-x{Ju*e5keKs-9ku4zwGi zq(hUq3*G)F0P>wtaR0w#sL-HnGdU{Go8y9yDAwgxqIYkp7Z@O(uaYh7kP?KVV~XVL zesnx$#A}*c3eh7xz0*H)p)g)5*gMY}Uw|n^qVks!zLQ3oqz~Auk{Nse9IxK zJDwtcJDcX@tSb!iHgOIghDmXIGLl4^EcEjrs(JD6Il27_2k0a%hk8!;6;M%+3N0Ss zdsFGNFc?FTyq9e9piMK;>1^BT7Bh;WaGWZwZy%}vQ3E?!X2>M7YnU}N&mXz=H;wXu z!P~H?W-5KO#}?Ko_5NeTU)}x+J${uETjQWbp-5f9zBxoBzw-32=?>+LjkU|8!vOAW z;V?hwinruI-eKs4b^IWCEQ!sCX^?#!FE!mhY@L(~G~$8}cZnw;u?Uvm$b$!^ueXWJxNgOb5@yHfzEEow*ctP`SWUfJSe4g-H7H^ zC58YTg2#`?U6^&<57E4!4r?AKsQfJ2iRc^5kRZI(w1n(xQeD(mwD3S)%J{#?p)z2j_+lIu>pE zu%loI13)D|Joy>HSDhtwlJE{BKa(v1?_lK~w#z?LIjR{CXqNH#7pP&?%q$TioYN&} z8f)?LQ|-rRp;9LLXt%3$alQMs`WW1tnTnOyH*k@wG1y}choEc@(l4;4w)<_cTJMHz z{1PL(e*L@K@zF{+E22sghe2A+?FMKDV^hfrs z=e&Z)z8zZz7_(wWl16k^fd}0SklP>siSVyie@z`Z8cz%<3-oGfQS98kj|G(2Wo__s z44A{o*{ULk@sfCu37NVLos&vR(`k=F-}l|RzWrW8T2*J`aOkIf67Wyg#TKYmN@c=2 zvfA5z9RkOFy3_!3Vd8Bixlj`~v!d;Kw)$w;Ef?}VGJ1K3R>V>F)5z(D+GKZ}B#Ijz zpQr)pxioQ;KMk63WHZ`0&&3aKU2RgfDOw1J~TRr)nQ<%aHV3cPoHCG0em4%+J&0nvlu}YW+@~Gl^t2EEJxJaR{j8VsT#G zo2>0`7*3ytx=L-Ba*N^ga1lKl=e5v?aNRO*i3*pVa~5pBEMmJ~x5b0N~@&=WB zUGHP_2SdHtxuPg^%6onAIlaRv*;(S?Tg_Qk!7`wO!UW+(Fv#so#*9WhAoWge@R9ma z^NU@-ypT#XC@t(8B7Bnw-@G<;!j{$oYbx2Pgd-Qc&HK6xMX|=IZsYLSS@#sQ9|tcl z=yvLF2tUx=wbh+Pl01Us%*_}11Qblf>E<^){&$`0kfFmen;EIV@yf_uL|OD=r%75P zUe#}lO(Z43)}33G-t$0PcJ1Q|Vc5{p1ufss$u6qZN|5R)sey~oP!R$0T^s0P>sNl| z8Y%XV4vFjhXANAzh|^iNGlLAjGROb%)ZC8LKE*8agHRPKw7$6M{|OSs4=fJD=ViA| zj8AtCE}fuf4-C;y9sxFK=|OMEa9G$Z?&1+|qIaVV6di**9ZAg9>t4q zo3)S{5T8uoT}=qL3b-12^IZO0I-EV;b-61M-yEzj{Pma!5E4O0+=4?8r=ulFKeTsy z=VjrtFuH==bsX;AG;DYFX~L7$SYFUVWdhSPhjC+(SCxgTHs%5voz~8v?#ibpP*d}< zvhN{=xMN2L6ug67G&_WFNKIvu`0%q4p(Tk|JIoL-{~2RF7f zi9jrwE<;@iV@~1$;i4$;*{f`l2iGMP$g60F;c5u!D3TUk()Yp}HZz7+SGdVriHrPy zQfTuVJ)L6niGX5R@6gMH;e8xZItmk`au$vcCytZKNe;vdcZARQ6ZTG#H0Ji9X zgsBbQYsva8-+(pE)B;#mR^~F;db3;Q5Ow{;n^%IDI}a6*#zn)!aSrRspTv7vXW2|};T z)-~nB&8mLaB>*>WFyp4`X~zljq^y0gXV5i=dQw{H2ssDZg6Rl!)N>mvRdgt|3Yjz- z<~o>?aselj2W~wUFxT0uu`SBJL^AhNB(i_8d!^Wml=5RfviYm6i8ATdIdM;s2b8s zDeU{wqMX!hC`|r31+(WYsUdB92}pG~(UEMjI<=Eb5nEsXR1m7Z3r7T0+$RrmdLxgj zPo(t1PMc~I{Kx?SGmX1ZK$Z?gwJ3+M*kr9Ky$HDK=r@m@@4@2d=f;JQ=#!@q} zk&rT#2(|3#!YydFac`fB--Zw$fPRs-x%2~0ya|LeQRP>0FW#Bs`Kp^d&jwsl(Ub#y z0APkPrlceqe>PXuk~Aad0O3oUwat#?$#XR&*>2n9KM&}6pZmsqikVb2NIWw!iw$us z-E1-Bw#ZF0^<~>iw)Wjpx2kg~+oPettl++3pfy24gn^Rgj$v?2-AV>TlP7l_{&boB zzSW?%)WJ|Er@rcpavd`qW3YTCDTqt^u2Ky^HzQ778>!7`Et?Zv{~t2O2_H{mA7J3} z$3hIe8S(7os1X#~vfWv>p$=lQ02e{*8B~^(HTORIG#m6*QM`qD&Cu69Bkz4Yi7Pxt^Mv@GY41Q=+R!ATURc-(pw|lx1nh+D|v(?E=NHiiJOvo(5bfA!vaW0)<|3#6sd#a z3y7CdE~mafNw;)i8@Ix~G7^-if2nuqQsQ%Agi*-IG#S;Rp_JeOUoiq_0#-+Mbn zj#^h(x^9~ijT=tez#D^W{X+Xt?hAOKl+Ox;13S={?z8yimLICOVh6?8F<02Uh-e}q zS-$Ne1{7Yp)nLW*(&tu`*IuNx`{%PD0EynIAuNTO9uPw!eY|aLd8dR%Hr9h%DU(3F z^%)%Y@jua3zXlqq6PUBpFiHfy4|)khb_E`Mxnuqg-!a8AsLIuX`8(hGQL zCY>&+CGHEm8naP6R7F7DH&6d(1nk-%d;jX|SucMLjTetq zOWK}jMJ3EZ=8Z6a6H}*?3sOkCbhzX)t1I>HgV0lc$;g8oKI(B~or*$0*4$Z>lDm)e ztszfhx`8ay1@{_Z4q)yn=pfR8g7CJ2Ra2x+6U+C!ISOqgFo+r|mANO;-nwTO+3bsA z!u$^%wmY*}oXIrRRG#?jXnIh`Zn^N5t(m_OA+VADYs_I7Q|KX)F=TfpL0}L_xdcTQ zN52ytlUNi~&h!$R_vW}@4ls@4utuz0XVsj2etqU%i`c2kLqZ0pUwo{)!vJSCdjLf&;Dp<`& zyK`!sh;u(%U-4`DoLrw429sig#1uK!nW;PY-tb_7rfm}Ed81( z(KMxx@Q|?W3O#2On%J4)L~-J=3;m`k$`H+vMi(e6>zRuD@7DXmp_T##=!b!0=){7f zxwf;SJ|4&|d&dD~j6(xTEigO7Zl&`?mAQY4m#c%VezBafm1c9fQ%s5CH}`x8{tk*k zD_)|#S1A6>J2mno$&Bg_6r}bI&!t}rb`YIvzBE0CTxX9mO@OH!6ZQ74CX0 zbRJ%ulDPAA>B1*zIWTyMBSgf=(a2Le3KjCTmn3)2i}z^~kGdt-qOX{LICXpVPXYw8 zHv|^;vZi5p&|obz{~^_*0(6 zXsmek?|&P&Q^MzMWBhp+Kc^_*gd*r^&zsXc|Dy_!SQsq2CDqR0YjTYt7e#sZ3!<#SWvzhiLq5+SZD^TBq^(o=r)# ziS~>jS!pt>j2`N0DgFv(!#!;4o*+Ib^b7{(<1ocFe=zT&}T{d$hd)5U$ zmA@gzdo8*rW1?r@%>CPW?r%hMofcKnI!Osk@G8*0;Xu|}|FiFez2ia95RF7qOJoqc znHzO;gyXLVS4s;T}b@UtzbOKC*lz;MO!c;g12d00Te3(ZYZn-0t~BQ5PrjRy5_ z5o*0_1`JufCqS2Kt@iHSDj-uQ{rmgih_?V7ue9BQ8rBK|d;pJ#pj={#8()9DmF+Js ziRt22V_RU22M$nRy8FRM1Z5uB)P3P?A`WH+>ieaTyDe>QRUwY8s6L&9^R%x~177-v z3ZqUFutTAdc51a!j32lKCb5A zB6(i~gRbicx<4JS4!HY$;JIQ)%Z3rkE zOqAx>B*8_6k#MqZIf4pmVp0f=59y_>_N1Ibj=`O0_{oh9J%ihQ{StehCA1} z2eX;uO+Qxx(M_aHg05$i8J6!EZ{epDG0X83E1MQmN1c(W!0wAVP^$|*o|_4JovRpu zo!NtPuysrf97Sb}HXag5E87S;d5AuXo@a zRwbX9$B_5=Y&K;ZVoF7zpVwpMjes@J?wy@>oMtT@R6Qf)ex)u(RE`HT^Fi4>vCwEh zeFb;y!$j?MbnU?pT_BsBtB>>FBzX@7l-_8fom4R}{Sbz|y)EL)Pc_#1VUHsF<1_O> z7ZBDuSz8dD65Ep{7NY(X>{b;F{p+9P@n~U#>3o+a)N1h@9pC)p^x6J#{b=;`4fLmh zRWKpga#}d=Qr5l2%$$Q_Vq@t|a_jd(ZJ=s*;*Nn>gt~t#3VlDKP9sJ?qS}<&9VF03 z(SHqxGU@TSjYra(-Za5DLkOtVC}GThR12@`#BQ=9Jo%l06V0^Yz1S0bdi3@t2e0lj z7c!RE39T8Xvg+$Qdsg1m|A%TLfaAob>)LZ`Vn>c9_{o3Z*_rK_1}oO3=OVo>&|5Np z7;5**KK*ECn?LslV<)nHk2!cVaS?Nd))ymXbz8cOsEZ|01!BIf>$!uuM>qqL;!qsI zcLTQp3Ey<6mu`Bb!wzndR)il(I2G%^!Se!Q!ydy#rpm{Q(vsv z&g3^H6lLZmmqg^GE?~jNnd+JasaxwnJ`GL)5rrtYVLFO>ybf;gRU)|0E8#O-$qsl9 zfw7m?dw&o1l>oQuieDYbD27Tb%t`>lK+k)_C|pvEyBUB+`wJtNA@6U6v)8Qlw$N3o zVuviH%%HOrNop*1L;f#?N_oV6hFv8Y-;_Vd;zaYuQWiP2vi=Yz)mIUdOWDy-R}@r6 zZLm>99LhApB|i@&o>&Ga299`O0=RmOKkq43&7sH|7Ht9XKIS-*$g#M(PKw-9-j1(P$-{;s=Va?OR zFR+xU%YVF~o@AzZG6)t`YoyU+=S94@O~gjlo0h>$`cMxq*5$xT-S*;39-Fms-`1o? z3%1qR4&?v!N3*SXbx`Bii@J7eyi_7PaEj;~hs-6BcNE$UXWv=6OV(2eb9+jAdU#Me zD&isjwES}g+Zy$*+P`71E6R!&4>cZOP&B@#*SDYB5@>`Ox)U-zI4WeRzj5Kzi^j@{ zsSjYX229#tklMuif|fT~fbOZ>2{~4W89c%|AbRrMl@8MT7n}AR$tee`@vP@cc6z5i z-PWES<3ex<)ejvXmd3*g81_1QbjKXz?Jqt0K~O5}dU6uK%Pm|}`5ACG?w(hMVLPKK znT!VRPR+Ri`EhQm8bU^bQB??418(lmaqx0ph#U zr%EM-NQCY+2!0*h59)3=5%uBE=TKHug%W&+mEjNy_eGxdF>D_3a0p>G@WSD_y&*NB z;SPxg1F}l`NvI`a!nR*-F^ITrUopy@M>tmiCaPje;yLqf6O9#SSv#Z9+Si z@D|cjhjK=^c-{hp6{56d6Bf;4;I zsjFBqiu584is{J~cBhm;#kKAHF-X~t3gyXsr(puP z4NWr5-AiM|awoK6>1>#wy}cqX2C_4h0#q4&@;W4Qcp^KqVE!%pQiS?b z(ILLv7fjjd?U2ec4ep2-%|P&Mt~rs+Y)?x=jX{$8ZZZb5`DeDe4bc}N0MRPZeh^7# zR@P%OFxRg#llFoWNuu3z$0gLRTZYP*PAr$LbY|Go32z*EQ*ZamnrR^}+sdS_P%2`u z5$6eblesq*8f5B%O+;(zFOB!$F} z#GLbQbIpj|s00z5){w517{Jvhwdn3ijaVPCTVII~=efoKDEM{wrj_qmvO&j$X_{>_FVyvQEdMD(&7ea@Q$NislgjY$my;@>drmFR7q5DXPQxs zr@09l6qZl2lcF)xV>~!vb4)dWsM)ZqawiQ{s6R)dZ1|Ur-S$JGYj(W!V~t0(AuY+)uxqs&4wcLAVETc&-=Xu23(NXAf!; z6z*|NA0fwiOEmG*O}`=MiQ;A-ktz1AX8q=)3wIhOo^&mzJs~hVbmzc$vPoZhXa%no zkoxHrlPPc&Qx{Hvte>vWhK}Zso4t)82I2^dXJTrKMRnQ8{TblspagB3lN64QGQ-{8uO4r=x{<4z?b;!)&nETzT074hg-FqIWd>r)h%9S1 z?r>0%TYF!?*}FiBEbv0(Qq=N9^#K^piL9%xo$iET#WOM3{-a;8u`M3F%PPA!WzX$88 zUG5odY5;y{M$Cx*8<#w9mpF=qA9DVD$F(eFfBg_1?6?d$1( zu3WqQ_lrUJQmsl}7dUA+1`~F~2f1TARIDb>g|M4bVuPitthR;W`z3ngIP|sR`vxp5TEU7tHFb%@0T2gQi}35 z#CZOq{|rkX?tXHn!~l_B8WpR?4jg*JDttgE5k202YL7_nk^-$f{m7qzy+d$_)6fwM z3Ti~rne>>d1EA7JX$qZEBg$Kczfu76SCzgg)(2(SW#{y5-uO~#1W5#s6(%^{nz>R7 z#ZLGc?9f#48-O~XWu-1g;8HDqqW9h(5pM6p1=I4h7XdYJ@?25-;>B1YCo=&f`W0_k zS1f{FL@lg?z1C-;u~5I#Nn`ErntI*F?P&E#2ENzHtK?S6J1zwOuF9?u;qqo*Rt^1- zU*mec$V)Sj`vh}r+~e8og3Jr*#uCp!a)#+if9BmCxY%?$Ou`loQU|(wd8q_!$9jnJ z;RL1aJ8}U!-97koJ?n0(W#WAiX-46!7=kHcz)QulV)5Y_V6qxLKYQUlGjCCW=V-LAM4M?8>NEd)H^42oQ$Jnl|qO}a}COQUeL zBxK5x0BKw1mPyhAC06)*O^J|yI7cwv3I(hG1}Qokur>wzKWS~@6%Bs+7I!q@Gu)-K zkaw{0n}MY0sUfGClvhyt>aSqtqxTK!vf@nTXnhGUr1IlWx)F)J!gDf zb!RN>-~CRh>5@9{Er^>eA45y^q%DG2Csr4L#435sq#`8x)ETXxAmVDCGM9DUa4!i%Vj`IM|d zuT*M{2==S4vvi#_roB3So_kQD(QDC-NwOw80(3Pg#)l(@tHW-mR%lZk* z4g>F~^L7ZMpI$wI{vA}xYp%VkYwuG|p{r!>XibCiZVy>KZ-o!K$}U1on0MQQY( z-|)p%2#=;iI$^b3;8f)g^*JQQJ9l83e<3Y!+7PLw%c?5!F)S^{7;nJI`RAf_SSolq7wO9=8h+&K3(2k z{LR;lrpP&(;J(C8AC_?U(y4@14I8zFqOQL zG?Wx&NdUq&3pBK%^5fJt>=f+t^ZY}Okwy0!QL+ilvLG&~SF5(oyTKb`VJ(~dy*jZ{ z3F$Gy4%a(5Cm*UjQR38Z{prvErjE%0S3IbGhn%ts=$=lBPJBt4{XI?wdZ1LqLsAvu z$ppPHK`XrZS^(5DdPS>vQxU!EPIE~II38X*`MTrRF>Y>PUnevSzAsm0IMwEO=|xIl zskh!>Acgnm8Wnt0OB7RzuRuQQn(tJ zYqu;E!jznxvpPD{0tRcoK&B55nVJTadgY|v!AedLPx5%fe&iB$>|1Bl`D%?VY-Y_+ z;S-%6`Z%_zJ?$}YU3oI8(UHcGaPpGNUkg&qD3@T>Ca5Q~L7WH*k=kI2JPzD3 zrP83ZJf0X8B(m7^3Z^BWBqu5IF#0Tv3vE6QLB^ffJM=U;Q~?7F6+7=MF)^8{x6Z$F zRVWi5LvRw`L>9AV)$bz=WlVH3lKbiy9hH#!41vRr0wNLPMI@x*@53=}J_Y~BFTRp+ za-#shLVs=7Z2)i)f;7%OfC7n|XJ;W1&2I$>4`OUOY&A{C3J0u$CuxCQP5LSW?OmdL z#GV^-Fj0#i%^B@ek#qn&6OG7YKUo5^8&Pw(at2Qwp*~~&lW)6iF6NvFYL=z zeKGev@o$g4)W_xn8|OOgqgrF^dZ-I62U7dZdkzk!D%1Z@EnwjLwhdGTR$&Ot-4c)o zMv5ruLG0$G^fSix%-$8_wm3QjzQJo2VqZqZe}X`1z`xgEC58+i{^5q-VkCaW!C(al zr-QV*w70JK{@2*1lKKWM>KJ2?eejqfvJ1w0iP+K}%&XGVWg3(je8A{Shm;I|A%t}h zgvyy%Tzll{-SOehRf(rgN(_o|aPdXL3pCCeK7bDI3CqCLNyy(;4&tH2sbkjAtN3!wSk7Ml5FoSvaQK?S1&_4odKsKpy8P8^jB$z5 zY571t^GRssKu>p29N?nHPL^=5W@W_bUvVs+@u34$?{t$W)+@o-lwTB&w{poCObKZ3 z4kpns`~+k^6BB%u-9)@k{Uj{7)i0s}q}2$v5Tu5dh3MPg=(cBhwZi4!H9Op=n7~~k z^_>X!&Q+-(uLbWUl@EXU$c%#Mm6f!y%@GyUU*Y?2bcCJTv*|iT2dEK?Jtq?4^+tIW zPC43Kvh4t1%S`V6DDWi8nWQm63`I`+SdEqb`&tGcsN$qhZ~`&r^aj|wji#THct1#}OZE#ylE#8!k4A;)1Hwj?$z*F0( zMm^^S6f*_#BitEeX-@e?8P{~1TFC%KMx_fFOcryE2x4iHg=J`b=2>D9s6^l*zZFb! zWNQup3gz9?o7f?VU*Vii1)yr};eH6I=$0Y=orAY+YAZB<&vlm6z(DnsH;(c=%1=`7 zr!o;ib@7C`KUg)nO2zhhHSv&fb_Z%Z3}Xo4^a+DC4dU2I=toWM6Pie_%i6-IGae<^ z`uV~gx+v6(^e%L1g&XFcSN>j=4&op_3;f==tXS{NSVPqNIOF8IEWcx*beg`AD6m2PQOijuRz;l3!F^sh<_gELoReaGBS4*7CMCtn#r;j%(MvJBGvN#g0<$9)N(06jRfQ@Vnuoe+-}vNAzGhMF1gL zT+6AX{e%)A-)JXjvlpDr$d>$!mqM%5(y98ylXs)L3NhNA{TR>7fJWNQOFdDh%Y)6P z^|6F?w_N?t*x0*ESBc8eNN<<+Q+Q;|rt6|$c7_wvE^RF6vEJqZXt zy4yt2VX@i?wwA7@Afr6S3pM)H{u1q~UOaD| zZYuLi7fagw8&1_)^g`5w(6Z@C6$KcZae2`~ACMFon2z*4uuS{Dc~J z=fX7`y{aGvdWT>!a{i1QwEFY8pHxBHap6s|eqJ%1=#f87Mn7D&$G@alKVYLSthf6PV6I-p|LV2dTMG-V!DP>r~d4>yEyq4Yy^H`5}F*pM@ev(1vGzfQHo zzJcb!ncaf-+=b`5pK2}T7@_c`X%Z^I%5?6U%Y_RVd_G{ZL4{-qzEMPyMj?vnx*TDL z8!z(X`_rkbPX_bvDELI%mtU*+&M#cUqhy+tf=Cw<)6B_{u4@QD+-^jN77AXtbsiJ4 zv!9D?Zhrc-P`|VZ)B810nyQZc5Kzeq4n2Vk2~I9xHzQKAYu7~{|D&!pkx+BzbyEhZ|BIc6`DwCd3nC*##mq$;3T>wr`AkmT%|O?IpRAX=f39G!F#< zJkErI27HyWpc_NNTzRZ5Ag#&yoc=*?MQQeFGzfV@Z|6S8PL;Q9q^y>WV$`kZTA)yo zjAKu0sB;9>_*~#_OW@#v)pKDhLKnlP*{8GX#rN4U(+kYPbh=mwvrID7=2>_!c8yH_ z(j$&o8g#FT4T(5C(S!ma?Q88^+xt;m{+7VXYn_?CKX6TxdO1hg#c5H#zllgWZ(NJk z6;jVok9m_+yLg=Z3yQ5+#Ez9+$*2|}gfpbQ@Mk-zMD9j}7^8C0kHo=QMNwJcmLQ5v zVi&}PlvO)cvY1I0oJs3Z(?V2i(EF_f{v~g4Lc|(SC?dm=8}=YI^~=uS&y7E(k=>bK zBZ=p)9Ysq}bfb@>_>Sr{x?Jf=^CHnN++>F&6bYAbLXv)psH2%RZq3GS$^l3eZ~~+3 z`b@WEh`UGg%Nko*;vGhy_L7e~$ks|!F{Qv`Q)H3rNL>MZV^t3Wq=FbaYMdLvOQ9NT z+kqfr;f?vskEM;?I1h2fvb88M*`%Q)JMd_Yvuvs^Htxr%`5TTp(M`e{O17I+`+i{` z8X`w*z8fWsZXrKP#Fc+Lnf@o0Fs7GxOg0^Et&X<% zMtHSZu*Y)lCTo!V9tpftnb7KmAphWTob2;|z zajlfuJppUUyB1JagoW=4ipNCkp!*fv-Rs?u5xbqrDCVi z`g)P1W7{Koux&|}G1HomB$SH%p^MQ*ru(-|Vx52-6W?j_r~ld?l$k*kv2ehJZDXG- z(q38E(Yrc31a@g^uBCDxLGxvGY4#_)YxyDvCr9HtLgmd3mD4oO-lga`jM$VMej`zH zH6uc^ZzzBAnzX#r}GC-9i8;F+XT2=%*qfMi42 z_q-v4uD*ZujoT_=@B=9Yi{b1!^LJwJC8|3b`_gSSsr+nBgPw}9ZW7DSU`TAI{7%|S z6##CafG0`~!aGYfn${J~DzAh*Z|>C9JZn>n(cQ-^)uBuo`2NIIe7nK*mMtSWy&M}R zgk?8Dbf;{~VaI4kZ549t$q>cWv1iN+y96A+H$X_Z;(2G9$ur~@z|ify+_xb+6hq{* zp`+@uKbWg`6Pa=_tV;A@H6Rj3h%KDu3if+j2k@>UU@8+AT+@9oW3Hx|K^(-3*SQ)VK-x^ih=e4=t7gF+ zob}o*G|dq`3KvYIdgj;IHCmJAbkI_Vvf_1U#E=&nv|8OQmlyyyWRl5 zIW2`9xOKoJ_gGpJ%PSLPGQ+O}jWuZQGB|fhq61tu~Cm9f{<|}I0)a#gU6t3EyPC?X4dkZ^It_W z7DP~R=Pv#(-~L40hGxaPWSu{1qQpm}^JK+NV?gG9oUk20Y07s#7{tl$yYl^pe_2>*1%jPp*fylfxLhRkb(S6P8!3iAT4)dsWoiBOo zi>=8?=p3WaQ=@cnH?A2Luylac(u4~ZYXX39XGV4;ScuLpw|3)SROv^$z?m_Prp~an zzw^ANBq-i3TD9e$pdoWgz)GL!t!f~K0C%bqmTNzC24BKWDzJO-(y=!LjH^cq;~=I` z$d>ZG2DUi4)UsMy6r!g{7{>b~3UlAw(7p@1Ui8A=`KP;V-K(e%KqcmQHpcm%aT>33 zB^1%g?{K_~CU}1^$x58OdCE)Zl_+`H1B#Fq_(@YYvQM65w%w&dncyEi5HQ(ehb{O% z&brL$$tzUoDV!XcT0=U);sdD;d@oH;$9ZP7J^dQJBavRGYl?pnKygR(bu2P; zB8>RBk6JHU+^R^c_YCqeb21R=0XiJIq{%6KSwQ^ zqMaNEN{Dxa*Kcq-y%1haGX5~sI*Onxqfh^=5YrheO=Ume!?!CcI)VJcc7ZUTEx#tH z#{T$F;l^HYBJ$%KpZ<^)B1VMtm{hJHWly37i5aJF3LA(Kir}J|bX{F${=_=$rtYew zym9dQhn2d5Zi^OH8KPa==wqeB25TB+gT~7N6RiYE`;3}f#%>PAE zdc0x0tbz!jkbI3;70!wwHH#LrECsqHS(L*jv%E9Q&g1mRI+3}c-&+f86LYp%;jLuo zEw=JmRb3s@kwH(ft@zypKxC*An6JA*{YL_Y5E8Hr}@mM%fJ+$VUw&#neYo+R6bDd?Dv_ z2c%e(W&-XRIRPxSN<_lcqkw{7y%koaUb`hp*rQfR#LDS%aTmO8H3~>IY?AUH*M(2Tz;X$>6gg5E-JEJ>LTT3G-gU>V9sp%f=xZ-ZVR;-Ja+P6*jUX5s3Sj zSivJtQAl00y8VcINi$ngOx>9o67rZ6eTYVC5&BDV*Yi0+A!+*a+uN!7rSIlJ*DwB-;i+oh=)rz z>*z;(IBEbt+xZNsEYTSVrGPrh0X^eJ=zl}_D-Zj>KHls_PO98}QC0^UOidUt<4&hO zXv5NDhsb)Jp=^KJheN$P-sC(0w9Pb9pxWCy_d*G@L^9yXQ%5dRuFBQ%Ze6&AuRjKwNsEd)|V48fW=q${-t2X2dgi z9lAHndTYnsy|dV$SNmPnw*^$=f%#EZv88dDgMV`;`${E3;=Bvu(ezI3!zh&!Iy#G& z${zd0)!qd*%wyrteX~TI?0=et7XQ1{l}fmU(*YlcWr|q!jb>*IS<+EE2>^jhy#RI> zZ9NK`Ko|I?UpvXF00v(~j%xx;)cPNF+gfi2956VWZyn>}D=MqVZ@p2_%SafE=DSK} zf4v^n$rqbA8|mQJVen|5xcn4NaPR8J)Gb%`Sr$;=$n20}RZx2rseOGFLjo7 zI4oYH)V#w!Rkb%GKAQLc9Jz3paa?_(>++z5upo7GbK`MuG{{5e%B@FP~VFZv4tPvpLImM=J zwZ2WP)|IBrZz6<6U#ttoYb-m=l0-78p{{0ukXma8C_>Y^s!8+|(^qVj{PXp0~U;MdQh5h(*$w%H8YRP^F zGO5G8*It&q?(L&y87` zK+i z$PNK}pCbeyno)#9l;<=AX3mvMm--NvZE|4n7_)Ho@nt`* z9s!49p*gNJt)KSVGMuK2&^BmhP%al$OvN=uTz8m4JjG8=ri0i!1f0!us zx4d&v2&Itr^-Or%$?`ri+r{nmrq52Y^g5N-5Jfk4!4hMyE8mZ}SJ8N-rt1nn&-U%U zV87~bJDfRJ9FKNwK?Lr|#6Y*cUHT>{dT+FXoYcwJ2;Q{4M9YLUp|Olei5|@^zocS# z{aB247@^k1^%_JANhO(hIs5?%BPaOhFyzdvlmL4@RUg-F)lgJ+Zv=&v6=^}dlDPBY z1{U1a=l>?Dgho?_DjcoART7+I>wguLFq+H*9IgjbXyPuHhQe02w4=K(vW9lPX6-m^ z)VbKB^BTVb9wwX>r`pp!qECOtQ1v9PJ{?te#VDUx1Jgg$PR!hj1)S(NCW2J zySm^3B^!QCE0E+z)crhU-6n^g3A(OYVe}-jBejB!lQ7N(d)=u8-~FL!kJcR@M+*`G z&~O-Nrcdlp$5Qt&rh7-*SV6Mw7aj`$h|$)e;s`E!8BUd?tPpq+n*~RV1chJ4imQAv zD)7==Q2v6Ic=H0za!GiY!O%)30RVnA#r*3fNFtB;+JmC|~y$YJ8eMw^ij5W%{okTm2>axV(tk0xw}X zD#OC~gRC6B-eTAwuVQ^Xfl1ubb&?6M9bTheYdkEZ*svC~G8rgPa`^0!Cor3_R2OUI z--KW~)w5BVFuSj?%KpU~9Zvfv5YoKDW{gGV$`c4|551LIzJ4N2t*K_P6naIY-DpZq zL#JuL1I+t1Ht^2weKF*K3zhzSf3aw9h3^~NRm_PpZ`lb%{HkObL8r2g?S-l?U+{fb z=3G&QgJ-Ex>`U^`YEi`-^Ce?+r-1?-}d1y%N0z4AA9G*mt+qjv}KiZ7@EN54V> zr+Mt(ZsI?hgnME~4xwA=a9NWz)>EB2g4HAu74vi8gES5N{HKL`+Zxt4^k+d&VS*fN z*v!$hR~%l(6_y6bM)J4y$=3%bziKU&(pykT1tS^CpnTw?+LHp133hkl!fc1cAk{$< z=yM41CRdmD#G!HPQb=*oRTQ|wwL*ZM{IRjsax++AT&qZA%C?pJH9;t` z-5Y6G817Bbr&~yuao=xRd+SN2u6+OmC7-t2UGSDOIsde^a>YB-4a7|Oo`N+l?e2XA zAaE5f5?HYV0j&!AY!=)@!+;IJ;%K@=TB0R3BdM3_!);k?McA8Ct}d&Rp4M9Helc~f zkLfbvqH$yYZnCF*M%8G{m$0&o8KwSszx^A(PR`)~uz(8(IOK>Xu*BGY>>OLM7=wwc zNptK{bJ#Cw3LJZ+z&Y%#mo&~EL_f;bj2e=wW?yA=#f2VTS^8@~`>`AAtPufn49{!u zcEWpRDqD0xKV}}y`f|`lYi2` z#!AvC3zyOo$P4o6!Y__K$VsaD7QYZ-PF(>Elx4L@!4ZYb3sXzj@ z%nQ`hKVfWbgcvyvaY#1cBi$u(|@~<0(i| z@@#6TjmM;iBqDzkC{a5K&;H6x-QdxtEA1YYV+XPC_eeW1n=-j!T^F>=p-RBzjtnA_ z($e?6#%rT7qxkQ`hBi_V4Yjt%x70;c7(=&BJd;fUi6F+y!VE#7q)vtZR%lK7%fFoN zllc8E?Xqq3)YnR)C_``bVzOGGB%4%q^ha zn7)2|4}RQXX7x=~h1)Ix(CkuaTaH#aumQ{(!&t=(4&BD_Rz%YqW9t zu^$N2W|BJl;SJ>a7Q;gjTHRgx<>Q6QW%A)+E!f5W{x91_E5aJmS@*K#vnei<#kIt; zVr6{TAU*gLBXPUb#3!Fqnd;yVHR7zRRa(wZI4nhbRWj7$#~XUY$^=TX37m&CWK7?$ ziTGuEq$e`*rQL)I30OD-wKF#(eM&l+ZcguVPf(FCiN(t{*{k#!?+jcx`SYd%UJ(Ub zy{@<=5kjLLCCf_dm@%mNw~tTxzdOT7l{e+FX&+?$+v)ne;P2>@8D`*M8MtxXp;sNY zgHQgFKw6bH2{<~kz)Lc`d7?!e2O9?vjg+bxaq>w3@KCFgJG1y3`q6dQx!gTco>%zc zt6&24?Dc+sj%x-=8P~SbkYh?0EW0D9LdlB+&gG# zkG%Tfl?a+c4+Z49^>MjC9)u7Ke4{iynD(c$wEBv1_O#%Wg=NcLgMDQm6rF~A2eaWHPOHbvS(A05hU^}lXQ4^*Apv|q0FFfwF9jQ9QBk z#L&Y}b+n)S#XX37d_yl{;ZthmOW#vP!L&{b`w1M#>-02#V|>kprSpKyfttTY|R^~a!S%0>=CQS5H6{BTJ)l-KAPW>qw-fwuy%o;BUofF79p*j)R|$?IuQRy&dnb?Jero1Xspob?1cY#dKkv260M?CHK>oF-B{U%j)UU- zc}&?{HZ7NouE?i2EfvAd1dT>9DD7r8N?dT)r45`$N*X2oUgzL)uBQw$1+MkHhqrO~ zw6uxQ*V-So-8D-sXhG1z$V!)nq9t2G!`mB~kGB3Mx6E=`6eZXvLvw=IDI#FRe-kjUHK~+V63R9G{sOgk&KJYqqamXdgnA!PR~Zv ztkWr1$8>DnXWYa*U&tAiDmtx;|?*TH|TKp)Cm6 zyQ%_-(XVk-2NP=@>bR!x7U>Q3hWndJdzMm5@X3804U#L8t*XG}WYtaHkMxV|hH~(D zeI8Q}5*XK!?0#;G>ryry^WF^OAT@Hgd{}6H|HUXJL9+BD$P;w-w6s|D3jW10X(O7L zG`-mzCa=_vvEVK`F<40-i`%4Uzfq$@ig7s@6wyYbwsC8J4qyN;2QRqld~^bBsAn>W z+j%DF3aifDa>jur0S@rIo!xiVo8dp%H6blAHac{Y&AAkXp1w)Kd84`EY3WclbGp8! zj5mn|KxN{9aRTW!+@}M8{kHzYD`?@i3@;0V%ao~R#WIUTFh*-hJx-g?C8#{+2a^(^ z+~;Z*jC5h@7Fks-0WA^*y&PRqQ*+1 z^aFO98IBVhjjhl2Xz#gEbv%^tGNYU^A7mS*l_A0Si8^n0sB#GUYi`cqe%*-c52#V& zlV^pQe7D0eZP`bl+oons3Lkmk#X?$E0{B>!U+(*Fp_6kq3uc(_dPZce`?43t=B27e z=noOE9FimClqN0(zaNP&K)Bs@gM}CW<`NqW1U^Yv4RWU5_nE#^;Iyb8@R2ii$|E1! zO;A_(vwPqs!iVJM6n>QDsu^iAEjq0s$~nq`w`z8Zb%*>MRi^~(bD3|+2(atoXPpHG z4hAr6Ljaott!Mk&71j)Wt_bsVigyPADvad+uJAo{iy~_Xn9oHWDg!(oqhPR~pmbf_ zP?biFg?R0z`z8}uh7OTQuhh|wP4z_T>GQu>b({3(kAVE(_2<`1iIfHC~dzi*vYURfa1B$kKBzV#i@A z-bPEYY$LhuYB^by>tbvJDCM2oQFd#&FwgZT-hHu;7dDmrcwA6kJ-sde;~K@KJi?I3 z@>`Y_;f^E{M5mBYAq~Q_s;&zgOuVR@RSXo~%x&7lTp%tm!`L+zb;N~wbIu}0nP7MY z?9k1Q4dJxipa)N|VgJnv9{c(ZHvVDr&n9GS(GRtycA&rN($Ht*J*#)|;6e!ju}!r2 zM)Jpf#tq2*das4c<$$Hoi%Np->IXGi7*uo>XDXF|GC?Ozrls^LJ%r!*cWzMWx3X4K z8E?i$-3aV0p8=#(Bg-r8Qo;y{0CrX4-$17KFSi?t+Qr~g88{LL*#zOkq>cLzB&VT3 zsboO~#>YKLX@^}N4w(~G5!RmWuG2_>WdxH4r0Q30>V;Yj$@=UVI;-aahOLzQJ*)2d zAvmfJ(NjwnkXeUcXtc7(n0x-JG^`1=!>!mmAy98U=HoNmo=lSvw`i;3J}>5>JQ%IG zlRM+k`_(>sAz2U4 zqnHkB5L!(16PJ9N!&p+R7!&Zp{aV`$$(PYaR#nOo1)#~iAa<8~0RIxa5cyVp%)B{B z9_=FTk9u8vpOC^+(wH3;m{ao>{T2ad%=!t%R=(zuzk)nnq?m4@LpDqy+|XknE{hQ~ zJ%fix^DXo}KuY1oMiYjjgy52iu!k~4q>WCZ-!TTo%7kw4lE!zrQ_k3$279}K#~Dsu zy)aV(0$W!8R8H%J4Yik;>=ZXiz^YbaSy7KQ8@Mi)gKL<7*o0leCL|uA%#V zNC9F&wK?8U0s)*n>q0}M}o zaV>7bT$Z#Bf-gwhaH8LHG4@3wc&-@V+|ru+0m=sNl}q8}%cIPR;3A9qV*ZrytQ~ zghSoFz;%DfAsO@_zVKMTlXS6e5$hY^2uZ2-`*R>kc`}8d$eq;4#d_!c`27!2edX2% ztG$M6+9gHM=nwS?AlsZ2RH?0j zM~e!_%^Tu)-;KBmZeKmY*J$c=JE~E9dG)UQfQbA$EaBHBZ#Kq$swEinj(vT=pUJA; z410p*NlqL_DyP>QeXU0Tm-5c}TNds~AVDfajM%fD^%~7}=KMgE+q;#)1L*DJX;*pq zQ)c>g%iW&uFKf-jbZf7?yiZdi!|)VKO+FHc}4RAJwY0ps(IZ&w18W&Kd{FtvJhLHYG%eIoI|DWn3k}v`rJn~DN zqB_=$4l6#|I~G{rfKbtl=$(3yRLW!03wym_l1TF+x=B3^P))mZtX+w35m*Y|_$qA# zc7N6EpvbBcR}&fRQl+ zpILpX_rDZL@$D4Q#&ZoRqZOsC@Kks4aH8MkrisLv(IVA=cMnyRT$`=rN_ ztr$8tp_)-ZjuNj0y7rQhT{jUFxeGJ92ecW$o$m0Z&|}{APA7TUz+cx8Y8U=C>Nx;Q zJ1syhEibXNS`%;ahnT*yj~2hBrabyMhXC|;88Rf(fE5x=x(AKf9hKjjC5Jo(sEa_g zH|jyrlm7-qI4}=42{=kSD87O-)5>|1MUcnwOLmV{RnBOmeC+|S4`1s>*}_XT z9ey6Nb+t+ZPwQyY6`MmY_Df-ax@fe9AyrUIQjJNQ2u2f$l~P6nm8FIe`bE1$G^y4O z{=RFT8*l+9iA6Y4ztcajsWDk|0^f*F#iMjd%wyir9EefzEEY8W>EkTia!K-x*&u|| z&w&sOGI^uidfoE}f6ttbF-!syxhXkxSC4PmjgdPE6B~!dzTgj_&8}@@7!%`j;<*Wz zveh>D-$t~Q8@}J~3PSo3O8>w(QwQLfw8Q!CC_9(;&vQ`8i)r-@=R?aq#~L5)gu;4K?K#+DL<-nFs8Z>ZAlJ?z zGkD+rD6N{L;B|2=8x!B99MD`8Eq(8o0iUy80tc9OZn_i*Hjhz6<1x#f$pRK2+`RzT z!_7QgMNEW$RwGO4c!4pA5Px=z2^q`#zL6lvWsZ2-`kAQ65T|=us$oSl2b_R|T_Qs&5I>M8k?)OgW_b_e2E@|0kppfz=&$EpSVpGO z4fhHpsS{e{79{`2J2$~&f?I;bXLJdm}-iQ?sXQxI;W9|o(WQd z{n{0;4=CyK`pkpR6Cx?vVR`?QDC0cu(ItN69$1+%(dxZ}D!sxp7$$a5YAmG6}8 zhyeL40@@5xEtb(q_}2nkN&&xeEOL6n9m#?1W-fiQva!Too!a$kHMsxyCe5 zyfuLbQf<7#Ix_K$DvFAA9v-DG501_kgF^R0RmEWWNkbfZfk(k2o2{z^Y4Zf6h<;_j zdSOHy>?<{EqO5|$#qnP7QW|}}FNzvqKfx~>Zs}W8edwGhWVl}=?@fK^N&zH2CVL^F ztK>a+Vy6C&A$Q{rrY5zvHZ3~&%kNI=N{4{TdrPxR5YMY4acGGGl#IznrQ~`DO|AH<;(w_2$ z!*g&pOJeTdXE{#z{0ny{Y^ucA(hdOGmjM}`s>1PS-*j-DL^fzg8h|6UE~ApiywhC<#a3b88#3E|10{!)t>Ps5DXL2aVLW$u>~ zRH=5B=A5O%K8~y+eds3dsJFFJGK7dZ;}BI46~nUJX5BgY`RqWC$)3EG)E*H~U0{Wy z(@2VO#S;DqtKb|w#wG>>w`|}hPlI`796zC?0u~@3^pRFA+cfzKRqHj+5Y>s0PxtRP z{fwZxM{uvBS%ev0+mCE0_WiiYSLk$2H}AAMz0X0WzI_oi6&rZH74m@}&rb;iJ!q~Z zr7aKxdGn(6C><3#daM%)Z3VL2jJ24OQ~CaNWaEjXRHOd;Y?oFf&pPESVtX$EVv*5P zlvroNHNKD?s<2%f=)iu!bO_ZEAM&P7&CVXO`Gb}8Sk6>0W)Pa{l2fVHrfgHquUJ6t z7kQnjek|9nU(EuV_Y0yoM`wvblTGSXAH_={l>qAy=_+(Lqfh`B%i6jApPe@j)B)Kz z0g3SqC0Qvu%b6TfATUG76W6CPPM07}G8XJQU3i~=>g(L$ULM@wLw_ONPTn09it!Y7 zy+DQW`!}JutAqcJBC57O7MLTn+3+x?lUgT@m#=#9t_8`rUuZ(uk>3egH2V9%LGbHyAJ!ic*0&EW+zq$ZJdm%;Jd2iWNH=c?tLGI56us0j`MpxLEMYJL8GC z2OV2`x!%!#74YhI9N#CiH%rs~pJjiFQ(GrT2-@yGAEMVQK-2EHps|n;qsf7Ta72#u z=_`riz5l1GvWhQ^3r1P>^7=JM?1vn;}a|O zzaepOZ@3WtSgoFH%uJ2)}7D> zFNw8TqcNNKq823Yc7m_OBl#g=iWLk}wK_h{J9e&VnadN_mWW6g-dH{cv?B1s{KB-+ zS7R^73nqo^9R*C9-dua#vENdZy<-X7J$@*DTqTFMaUmhvmubO>VJG`ANg-XoCud(r zoNThvqD@2yw5m8gp}kJl)7!)c`u7yeyU?%=2Hl$?EaxDUx6_`jUw=4-cc+;WO+v@& zKkYhNSKP6o{^-G-7^!9Q-X*?c+U8lojb-~STra;nDzX_9zLkl{g8q`V;3om+vmGu_ z&0om};)BWG13v5Lc8F%DW!w<}c4kar8Iky5RW?Gh>fcQd!%*6t3<_?8`J#v23{p8* zkKTQN8xMl@NlM>BKj#n}4usD4>f9=ldT+U)qz+n`Pl8ayof3zzHi^KR5KlJ zE3iH-IZ%dc?E|OS57c}57o=<$#=MsrQ0wb4m;(Tp>22@NnJZOmf(ON$^e+xxNTE!c zX%wxBlgfmhApOPj^y~^|D=`dE5)~2&5%Zkp8<|F_b9YF9KG;z+G3c1%jLRc=KVDsV zQC@9AUU!bK5>GL@J$GTe`>LoJ565{JpKJIe+#0+Y^%}0CG2)~(L>B{Kf~k%MlbH0T zA)ws?<>zV@jH6p-oPhSqMh-bpLDH|AR@Caxs-Du;1&QLjAAoKfytH%Jo9Gx#aNuTy z1F2SU1RmG~I*z0YN;3k=G6XqPkfEQn28U`K|9Nr$LwvkCiZX08IRY(Gn_9LH5h#|* zy0+!vGqfeP+kyv_OZH|Wrz+a$DrRwpf-jUeb$k1c^d%B!%Lj@B^r>sy{{3C-p*zr> zGFMcYAM_tqw{kl813(~B*IPkeaQ>ii1(HS8pJ42P47rn`k{W{1yZ`~Z~_(O`nebp5Q^B;0DV zF5lT384+We;_~?6dDB`Un?an_ua8DG$#YYJN?5zg(lQ2y)}mW~afJ%(n+_w`LzOSH zkcHp=U)r<5(m@#wO5`pkfw>Hcw3?v~1K20$7*#EUe_J^fNL zdYR`GC5emIr{QbZ?bUX6UiOq+yuu}uHwkEXZ=}S8S~6KwI@5^S_sCf+QthaP3C~7x z*6N6K(7r`z@)k-4T43SDLoul>MZ3g7jyN0>JCr9%j6QWxs%eSEzyKsXy)+H9Uo^E; z(hH1%`GUUIj$(RJ2hj}kq?9gJiWtD{PlFd0CUTJ9TdCo z$ktdCyG^ZcuEe z_;{!!bjfJxtW|ki+b~7?Y!G7P&SFsQXucWW}Oxk04bsuRX zpAd`=vp|Z*-6*o{r^MaMm>XuqE=^jd$4e2VnzZ;-G=#|h3*AOOaq0*bOORo{zW6c( zWeyVuAnzWDGAx)FQscrz=w2J-g!@YXu1CU%mpgMglh ziQ{obY$p`dh(NU_%`C`7+J8>wVK)TLu&jX&lU}sH!lKN~g)0#-`V2=VRQ}K z$jwT6;OEL&1`E}+%=OhK4ZSh};+o&N)Cm%v!M0Qd{6s>dM>|^0^Hmks^R{Q=T7lPZTxv&9Ir?W~Zzu>lLEc9VQuRjK8Abx!3uwul?Q$ zdP&1m)#(;W$BNe2&E&RQFw+?LyhAmoQu2&&*{6(-nTl~wk^<>`rL3pTVdH9LH)0u6 zqO3|44UWmi$qNn(tvt=c_C{8{(f{y5=dX8P7wy!%KtVFJeR)N;f|kG|x`m-J&l5}h zwf13-2j|o79GZu7()&fjQ$SK7P@lX~HGyRDNnn5@_*48vYe#C9*fnObcLgR!_)0{k z)0x)~USb0$QavMov==X*SgIPdB;e*8NX&aJmO zql)IJ1xG^1xE83P&%dh<0aoI&yJS4b;^f&S)WX7h z2{JG!q<XLaI-yZ8nG$3N31W(B%;OltEh!{>Q1-3-v%m%x|_@Js4^~oEu{8gKf zvl@-Xa_t?i{afTrL5=C;1w8R>)^@qN!{>_|zlbxkL>N^%0f~a2sPmd#DB1#~1e4{;8RqbwUd+i6*gj%Q`Ow+wHXAcRqb6E5+ zI+)gCR}fQQ$tR#Q>+a9n0{oRQ>%e9h{B>^H;Lvq$7Fr30vW#@AAx@#IsbM=wRlmDPGt8*`L<4abEy z<90)f6wK9qVnqK|Z$VB>gy|BG76HH+fM6>Zt^;ob`uL5QRo%`VkWG^kVXvvfoz|vK zw55m0JM+9(Ao^-Bf-Kqlwxda&*DX*3*VWn_cU8M?UUcn+A-EGGtTp%uF2dp3e~=b{ zB1HO7gno3>Fe8WD)iMX?{~!)5uiO_qY0m*K`N=G2k?YAugA3WAc0y8FjxIf>YFOmJ zd5aA;y4qimVK>@A63YqX?GHC)eBe95pp#zH<&{0R8d1B1hYW&;fKx9u?&9T8J{pEt876CUf_g>U)A}EezJkM9&_6*~ ztZEE5;UwFyl@+x!E%RbiJBg8kT$~0|7wllLPOtD9P!x6N6gpxXL3}e3pSUNQqXulc zd5M5Lfm>svfoobBlVQiOUK#W1L-Js0F~~Z-5MCOD+)aP0V9T6|djv3+o4vZm4wA3U z#Ygwu6WDe2!0sgYIqy! z*b5LAU^CE4D{MUpLRw*ZakWFIkdsmtr1RQcX&^6@h-7kMaoZWygyha{K2ub)5_EqY z>|B>Lfs1Z_hy73bhFsg{Mee0uWS%n^Zqw_C4vKt4sk%qJ&na;>k;6$A{i)2*SH{0x z)}mMH5Q`#HuN8D(LnK9UUM$udCkEz4iv;C;s3?&X1ACGD@%SU~uA2zBM8cy~yBC)_ zN_qbOR>rkj` zU?slo**E!wP>@FT!QRh6Ve=&%`O6zgl4rHgmfsJJK!Yp~VCgd1q^>(=nMMC^Nm2B6 zmnE!FC==?qDsw9AQ;Dtms-JSICIDyWEcQmoDcIh@ePbvzfK+A|mp(W3ZQ$Wwp)@#b zfzcY3`+bp%=4Jy+NOAOOgNffn@^cE@%3{_Ye&Q2?mY1PdtInIu4U?(dWb<94LNlP( zZ`M`+7j(i>XEbd2$vzkuH_=)IzgpZ&4Lf5aj_hTQ#`DT-oh@^+nr2>lG3^F}qs5La ziCh-nK~j9;AO%CyfKDC>AcxadpsUDRu;0Y+$XeDwHD%nMY`|d7c*V-bRtvu1^_`N+ zv?SL14LVO^AcaCXxHgy-2rXCPz8$wtyYA;$@f{``E(Fy7LNVX7-zh4kcjx{9iT=~s z==Bgyq97{055l+$r!vpqX;F(oKXznc2U-EQOj-0|(>-B4 z0K&#q@2{#&sNHQjVkP)PUMx}~&w89R1pI+0g3BKm!vNr8&H6WLf-> z*$x2>y_+22vGWnAV*gCxHe+8FdqiH0Idx@^9mw1m^jK(e6Rd-E0Q%`Q)O?||!RS29 zw@71nX!e$Bt^t5*8-9y8)tPdQo@xXi42>f(g#U~=DD!JU4J-FpP3V;W?#>X)^Ea)6 z8v8_J9+p-W4GQ5EP_CJ2*))7x0J?u0J%BdFKoLNa$p=%mcb&@XM?bl>mM{_uEd&wf zTyp5}^U~8V9>A-U23Oz$u<@|O>i);Js|`%=^|EDbtNcRha%|maHVMfdvDS=60`*p2(l-hme^hqU<39& zJ8&EpWrd4S&=U7^o9JpquXn*o7*zz%&{-)WIHTUx5d#74G&q_m4IF~UCbG!s1KuJro?uNa zUopv$a#_ot^ed-tw;`oLjBam5yU8fy%0~ zr64okc(@@0>@zK~GHKN*T>sGVgr3bHLBVA^0TANE<3l=RAk3{2C;0wDynhFtZUaQz z-5XXV{Hc}q1^}f}x_N9wg*-~ia#|0}B3;cRp~1X-5Yfk8kp!T&WE8|SSN(`R#ldx3697|hfJlA`p2$H`+N1u+4j%q%XXdj!vj7=yIf9yV;8|`zT!d;q?7ru)oMxx zeU7Gwp;0|AX;>TjlNdv5u8aT^YPe{CC;3LMCQ9}@A8eCyId4hR@_FxKBUNLHlmq1; zfnkOy(oIG!V{YM+Z#2UXt4kdc8#2KpVsv=^dt6uM4sO&?8Wrf%?B9IYS~>%to2yg@3cR`L$+R{3;C*P5h?MoF zqGsRyS)2**@NP#M*|tF4n(x`DTrkh8IxH+S{)?(kwVQk9n@He};(32Cb@k_3-0>*> zr2!53yHjL+E#gavEM-8JO=9+#zFKq?Cb&Ql7aCtFFo{nGZp!AN~;LEOxZVGYUQ zmA0q=IPZB^G0>w01sqj1mUiG@1ufjJ_rW3G0REWjCMo6q%pKd!3~ix`AgUI4q1NtF z>jU=jrI=Es9wWDZ=a_dYMJ_#asl7$8R*v-yHg&!prNG`%dcmxO%tLGx$d|?tb0OcJ$SJCPrEGvW5Cjw39TiDJTWpXeK{vk|No~GQ1yq7V=N4ODivS!Hq&D0JA_&nqXmXl#i&05qM;wG7=6%0Rn{Sr)B#Xl{BsH)s(j5R ze;!4TJpC&pe2D={KkJ%HCJtnz__>q9fTim}L}wEK&LYLC+@XOTVj^~76ix&xGEt@}1py%D8s+rKZXh105C5Ws%@8GCWq!H;XziF|R}e zb<`*4q7w;L(D{VF(Jo?Uj9A7jFv|kSr+6gX@@k`IOjum}(m-U!T4T-;a#{I3&-fly zHx%>DfyvO*r}T7R9DSr%gGL>wqR6~Tr&)F5`tjs?Y`nXaOKbhKS0Bi!xL*>Q;AC?F zLsi(}&ypC*LYsK#W*NruDWQ-)wybAkj< z1nuf1R*|YQ>2wr9tgi?+EB)84U9uqIjP4Y_Z!hYz=JI8_ixL+sg1Vi?3!_Ol*pB8Q zVk9WnV}OInHW6Vy^p>6fUBqcwgy#4ub`gRN`!f-l?c@tV$mezy?W#mE05PFw3eTa_ zEl25hzDj+Yk}1=~^;ESZ(cM?ARTHBOd=HX*7pJ{A8dKf=!2dU#eia=!>JS($2X!et zqpd(T&^kV<-RZ3#MF?7<-{?hdL?eEur77>XGIpMjqj-VYtb2#3Tn4pi7aZ+KBVUgh z%Qhx`)C@>8{jQ4O02Hq2ERKS1FY7g|eR)!hNc9$D#=04ZLpUC<0^^0tCc8*57Z2i+ zQZ~lII#E^YSxKrb^7h{Cg(6O(FFOjd;y2IQS-F6Gjx;R#Wh z^*3u0U#4l+`PYZ@_TCxtalN_c^rqlKM()Y#`s-RX7nx2ZSkezZrcVjOhi+jxMSob< zF&;iwwkup7*thB4!)Fg3eo&FIF>k4Y!02=1CJ0=-335Vgx7L-}Y3^mu=x|Z+%P0fs zU&5u6)2oM45VKgu{P{{Zcu$>+eM>g!d-%wSbo}!d#xaTHdhS^|0KY{Es#@ww)S<_? z$`^=KJCaFnBv~!xWSw zjN<)fbF8R55A9Y7x&VY0MR-OjoyiI&@g=eK&qYXi?7-iQocZiWQHd~b*aWRvElGxBl4Q6SF;5}J?uy*k)NzRtmD`d# zfV*67{3CiY6`K2mw$9|`sg@)pGS373JOM9w2G{=<_7lKsf!vY)^PgiPXNpEg zbt%J)B%_kg2*G$vO53ms3lEXJo;QmOUm4M4aXyIN=I~#Z2L|_c-Rew;fbb;NNGC(6 zCKqFFO7&p@B{IZ^s7UsCF$L%3m)VzeG$MQ4s{{-+X0QIh!dR&9%VHe~i#0Zy>^nOM zQ7BWt_OM=;w zdwc-8tz(CTp`tzOT#g{44;=dCzD;sBri>-E#;tBv*nhR`4FaTlA#t|W?OFjDXlMrZ zr8kzXI*Sp`wA=x#2_-1*i@o;L zTLCdYzfeXOldEmD7zo7YFv~qrnuGhdBGcu+bhMlqQinkN!)GCelb3Ja5dO9!$Ws>M zsTg;QT)CwJMu}EH+Zb0b7jZ#cCRV!!gXGI5KyQ~a#TihS;9F>z7nWt*g42sy#48hv zC5MIP`u7COw4Yk=JkfE&^2I_!<-6|q1iUH@=&)l%rixqx;@PPnDzEQi#F)98Gz|oI zm@le3DCR&@dT&c9uis$|P7|vP@K(yOMf5pA z1h3mS`DgH~)4+A-q~hZ%oI9tL%(wF@BfTc%VkNny#!N=QQ)KhzlJ>xJQP zy{!A}RM`cQ%(z=NvJU+O>W95y>b13*)wT0!TMUxXb+)zFDVprJ^r$7!e4KOZH`1sX z@WZ6~>Ra03CRBp^(mNsHKmX+2b#P8zkDH*eFP^W49qN%<+dI*>w7f+K-$M|*L<8z& z4pEV-A+V}sIMXN@;$y{Nq?1jk*UOVy*Qw(n6G6Q4G#blQ$Q*e)RVP8f^g_A97 zRZSI!r$&g%of{4HeH@?XibD)fQqSI1NsoNnFY6>VA7Ytn?n6Riskr<(s6H)y9ymqC zIC8l%{=i+$!ZxzBphb-_`_ z4hid#2*LoQTFE$;HPE{!PG=HnxO0)9G0arj3(f5r{5grMWepW2n4f}=sW|=#fmFQ7 z)8SlRUU$0$?c<78kDv8n%@KQ+LWI>bjszW&cf2cD%W%fN=S?N6`$V$kI^lI&m<#pB z0VRL7mG4j1GrZx{LKJg?T=r&=-lq6I3^-C5(JT@MyaD&b3^hB!T)ortyPYz=pWNfQ zI5~Gyo&buefHRi#UIRkBPt=o#?rX*ijV_5vnA;(!{S~W^sj?kI&)=Z)Y)r#bcjK`8 zKeEtUd;*^}r;!lXBNSx8%2F$67qZ<{Kns?aAT1~mtWi+2G_=z|gc%`G*CXa#SA zwiFXs$>au|Pj?!^I$ZL(*S!YRm>6s7rGtuy0N#4bfb85uiqh&vA$-B>7=>93Fc4?QuQI37OR@nc)=6A)mQ0{5<8LTUle(sELP#*5&oYf?$b5J!-VyGu ziP}_`{c2#4!wpDLlqFp|5cyAOpJda-{60gEMvieR;zFNZ)Y(%s=K|ms_l@WT`i5gd z-)ZXEY)1(U6^0cqOQ6?BwwYjeW_UHO2_B4PKJ$mWx|o%)s2UFhXhb|o14N2~x3H4u z-^>+awe46|K|mn1=YRb)OoZ>w-;nu<{>x1H%eWnS7XL8kPdD9->bmHt%^I-*wA-9F zQcd@;RcnAXDL<6x*ng zWTx9L!{K_FN^m!FVE=oz^sq!zmIA8S#sf+>FhVde@ov@MGvsMYS>Ji#;6(gICCROV zE2VH5_M?CwXNdBc=!NFz7JCIwysd+g>eA(v>t?ByXjz{^m!_+V5DD> z9^i%scuDdA2-CBIyD4286$DWuKCwOrC#< zq8LWFXwY%5_kdorH@Q87=~RN=YnzoeK?MHniyp!6mo!V&WC+=GXwbvQJK6$+EvU*i z7BkqRN27up*Q2io9Yq@%&TD{2N^dAwX9`P75@BG{{5sO zY?xjm{~|2}V%CrTgzx?dF&hKn?^z%hQ9a+p&l=bSi7qiqiz=vO-H;ydPALXYWtHA|I>gSl`H zwwJ|aS))x+!4&`GK+@0iSDrpMVQSn^t;y`-`CcjVYY&ccxw>B1YcG+5|J&vz-VNxk zr)^Xh?aJJ|q|MXY%sw4XasDt-`HD6hI#{S~JLG_}5?G70cc_is(*!JBJ1YUcRC-y3 z5)1D!qN8NTML5Sgl$IcI7Hz;ty?l+033HmwQknzbYoqJDBCTHZD@6Uz_D4zY(~D2B zalv7JyYnDg>-stwQ`OiT`DX@S|Es|pvXec4>WbYWmHOI*Lcj>GnBtlt$R(zOBSjE` z&1t{&xuf+sE#c~JiXD3A4mT<;MGuc&&6XlE`6ow+O$Yc{G5=U5n~cDe3>Qoz0J7nZ zw`0bNKhY5$&qPU$afOUloKxR-Fx8pTlMhfg&};4UJ@XGs)@Fs+jjiQCvAPuebA*@@ zq+EG)qGKTb%}~19N)cb$a)&M_$leE=LCG~(TV6Yj9Lt<2R8)^X6$As?i^?2jw)E{lO!P%LA9?8PO8R%PqUJX zzAKu()3xXxy#wCbUMCG${pJ9e#R)T5NOLO-X?b|EP9B4m=~2EOHJinPIhmkU+x^oV zKudgWb;$-DdHpW1f+1=jl`?Cm4vX@aB`SkET_2 zgz?!{Y=dt&)mjX@W6g@w**n~vXSd%`IZN;FbZ$|Sb zOoB_+OB8F_lrD>K?_Loou%J;%SW-LRwA1Z&7RdIuc*N<&He1*PP4)k)?6ldt#b2=h zyyFc=L`|%*(<7CS3U3y~x;VyFaHZ5!8x2qMPPO8b{VEq56q6Aa;vdAvWxED3h2b!Q z1?X7yqQkt_#e+>})HI+F9*j6VV8^XyZf4HA@6$t$Ep+4b>kwcpGLRI=C|BO8Vxwyiji%-c!)}!$GTq#vf6;!` zy942ZP?x!Z!v5tU29#sL!nHR5+cq{@0wIddIAj!#xJj>wk>?@Ohb^n~4zT@n4tw}} zi{+L4jZo^j{%cYWt3K9@x5vk815`+9t*B;Icn6+4ri!#VLFYEnBJL{)7*DS= z3z!}TT|Cu5SD5t9CO)}O-S96GiG*T4gTh(yCAz`RtWzhk@pR^uO};c%A#XyXVs-!# z!2X=kbIpC1Tt7dR=zt(Qj5`!c4&#(?w#+zq75~irzcS-StqL~Gxc8TN`rmi=w)Jx? zaQp92%>vFHFA7iSS>%&`ZcMGTl;T;N1whF`@t}0vWJ&rNw;*}gso84BH4u2n zj09%s@l{zX7(bEViUm%sd112a8fJLP>oG@MTqcX2Jd?PZCU0U4y5zyB{}1p>+Rmftk3x~LFLzbmULZ`-Q)T{K?nLe3!8Wt_B#iQ&z)Y(;7A~G;j0kmyqjEX* zX9R@D$mT!2pij8vM1KMqJrB=~PEqwH0S-wB>*C96K-B8cocbr=hs zcmXTu~8b@Ytq;>9tU%nQ()RN*A!w_`XI+Q}?3An194iYxfW7%!c=!4+V(f z;oIhwC>lVM>Mvi%dHVgqF6_p4d4?~)(A8-kmncAqU z@YGtTOTZvJ!KWB##Vsij-rvLq?8xaHa#Z`Bbe5NF;y>n)%P$JL#6ia=u_=f1*K%ed zQQ0)mZ-e7m&l7FZE??vz5og3Nf8um3w3HjvvAHhD=@AV*^WZ`~%r^JgajWrD20Kp! zzt;IKY8F$Ifd?L&*T+XlVUkYC*pd`>DMzgK%lMjXo6!S3-ERQw0C&@Tz0tmgKeWw` z)qcajHdi1UC>i{NG&2Y}SY7}^$!)qIjLw+j_c#gjKSpj&Q2)T-TWeqRF)&E4RbtdJ z-KG^V24Z8NlmN4_G52NIyB*(w71|$yO$C`98rt(>W=a)S;<+)|%sWGHu6SGtY9O+o znMWI!sjL)qB5SH`m*qI4fQ280Vxst@)X8duoljnRxV=LDz$<2^n9&q10)R9Rd|j$B zk~d%Ajid$ujgEoqgmkY7H9N_2d{9^rMIQ1ph0vD~)1=0JTD@;Sjl0-HIuNw1wa4#P z$SocT%ec5|#bykmNN|%nVc>1M83S%Dlb>+wRI%o^UiwHZzo!NnpaF+5$-tchyN`I6 znPS6jAkYol%PitOf#>P*OP6q*Yszafj(PK!f|S^M+c3|XTh_?$b#f56>%PDEs>MoM z8IN_BPp$@?h@`lQhV^E<-0K1*=H=Ky=;LR?W^h2Nl%AC=fE9i_;UWY^x?n=|4x;|5jm*0oR48p>$fVWyXJA^C@?2lORnF`Pg z=>c%6&I9HCa2UIh`V!H4oCq3lb3*{=&Ur@S`VZYvm9x$!ZyESi@%gKWD2p{BGnV`5 z@WM%pz-Sgr^@34efgR1+h}T%p{^WSBRumS)slR`3BsWa(9@xR)YWSzT+iw6OX-o+4r)7up6NcpUf6+7Fj zkkeljaUJrf?4z5o#=@Ia!fR$8t^F8?>b)QC?k6EMef~o&EN#I`E@p}Ne#Na#s|AGv zpFx~Y@a9Xz=pI)E$X@lD?MW3}0d1EEEYii9woH`)Hjln9BfYd?{Fe#++EKFJ;U@K{AKO(ji>zX%h(1=n_-j=HNo-WMj%jbn zFfeq@+-@?|H**1{fU1fddandUT{mFc8hM46E)8#$;}s@#SMMqE26IjMywmADI!KK0 zN%TkIOWga3%F-8NOaFNHyMhWwPyJa*KZP_hgo?LW) z=Lzr+lBo=R?CkBZOb_W#h+_C7?!vD` z*ZcIa_B1MdrRCdHTsYym?lE*Wr!c6H9DWb4VeGM&xS~v+(}gLcSY(t-sHrM^EfBJA z>5v5#<^N}VF3b^Ffe3%`j|-j#rzbb-%d_7t*0q>%jr2aUX2ZGQ0;b*wgB3tuvkAnF zQ%6Lcl*BN@wozSF9t5**ERh3qoO^lPN{(ez3(T_&jhh`Nwu(_lxR6rk!c#83~psiK$th7K+yXaUh(ptlQaB*x5fiDVWPp0?ZX5)2H0o|~l z{RcaN{{o@IR@&q|GtC=u1$v$n)|)2vCJAESr0`j08Hz4Uk??AOa6Z}d2c&AQ#C#Cy zOHX&b0qb^Y$5TAEKYa$(xxZqFo$mn-Y)Wnss&e@#KQy*IX;v(t8A$~o+9OplG1fT` z!^0Rv2@of#ddNC+??pR2&8_aPDM5t2fy2ESLV{-4MLjA4$40!kvUnS{9{-`zK5;4l zEJCu8!c&v?s@a7GJPH>+xYo34WX9DL#qSTw!a84-$xxNYG^>YD@2}WgS}Wyx-M=}H!up1UNFX!54k)zLH}s*5o&zV(PlP(BK~NbRi=m{OP6nbcf} zylr|um*~w{e|vvl|I(zQCdNbS&O01`u!>U?40bFbcn>8 z$=EhW&~v2ou8elGz+vqKgrmn7EGfKJ>IgM}kf1?y92~;QtdO97m?Y zj_hRLnWp$G&ck~+8{owZgh9nCykAaldZ2=Lv(P$+b*NAWz$dL&mIJ@$F8b#+fP2yj-FE#B+xgQd>$( zEInxBOb1ggrho=iOC15MC=5FErRSX3fg;_^TXroiN=a=nK}FH~^WQFe-^{MOij@ON zj21S<=k1S3I~oZ=7av7kL%E4?%}?vQVVF>@?C5{*K8(g!UM2SM(Sst&NGvR`q_=S^ zmhVWZwrAH8#HlS4sT(*O-JGMKWhUW#N=X=+??l)*X80c2IO{(TbO^gsSiWRisuqov zO{7`sOQ&fjpcR5MA)2X#vkp?s)5mI4tYZOnlDZ~yj`-(v#FxY<40JODD*zYD<@uj3d^d^+A)#GZ$*X%vfBY}6DGdWFy8^!o7YJ`>Vb)#pLS1Ig^hJ5 z`+eNGf0Gbg&{ie!0I?)WIzFa>{v~%jSy>1O00faN@BJd@h2 zq9PD#K|a=<>D_1~KWjzNbahuwS_l4DH3-J&P5Lvw_}-n4;6FO=@qihXcimOw(1zpI zofpJJQTi3+VQl%4;I00mc7VjIU%}D3pv%GqiOW=0c9ZRG6q$bl9M{T;da`)1m(K?tc*A;^c1<2o+~qB-}6^1+yK9j>15WI<;ZxD5-aM2EvNv@F}J83fn!y+LLr3%`{@bPy?WW+i#!wy($kyR z&SJVzxCPwCXeIDPv(CzD2hQY{t*C|>ktKhKI)6B0f76DRf+Wzs;X`F9q`ZeEg@p95%KB74~- z+&?@2GHp<Z5m)!81M)8uI1i;$83I8z%aculreozsA+>IOGY@0d!LIlVaSzY z!aTwRLKCI;AfE*Dg(=qc21GbytmLT=)aUs;JY@zGce2YQiQ1|EiC)JthDY#QOTb)_ z4>Rn1sD5UUdAs;HNPeS#FiJv{kA#Y(bMW;$SDx9aq&c95vHq`3AUjyHj5i4+8%(;C zQ~ihy=;*>qXibQ*%I^O%zTpg{{h!2!_$TOj+;u>Kc?;+SZ8m+kv}eNn@geYqyZBJu zY=)SYw>|@~2`q`|XHs7fTM09G$VETnq&lH>=*`x1n{`z6Zaum12Wh+yABWoR>UbIo zO?!L&QG3k(b52SW)t$mK^tU~~#Xc%l7kz4%B-P2qUY(o+Q(v(;U5NU;_(E6c2M>@dXRKyph#ZeR0yRT$+aY=n z?|H8kj8A!2Jro&WwwzW(@XGjpNF_uNpM2nWkXOzFpwd)p0AE&|R4te@a5Va#U#{3= zZ3iehI~FrdD+ArHIqsr6oU5kt>qrL4<{f~oci_7Jw{fmXY6X@RJ>@-N@WQW2e8N9n zb~@1w+tWPzxEMV(@Q(yNmA?n&5?|3sz!-)ewtSX@z*E4)~1xnWr z!5?tW{yhH@c=HbG2M0kFMR*0-0A>YSt!SrUBGeSPCheukF!uX6 z$c_)3Y0w4WnOJS`51B{^d8uS?T>CWc+CWeWr9ggmOuP>!EK>bn=yO1^78dvUdwPlq zVJO##-+(>YG5tF-VhMKxYUtQv9zmBI=(-6Pp7lK#P*tU6ITkS735b(qVI?;7=z*py zI$giKv4L`uGO}F;M3+|0W(*)<8)bAW?2+2i9cjl6%UW;e8K<6-|8UuKUMY>&BhPtw zuuw;tdZA@(1{BhVr{-HD%oDWm@a80ho>dV8g0=Vt-tH~SIU1vy$4~m-dSkx~2vX_>z|bhd;-SK8s8)J8BHq`gbLszDcV8D3=5o5Xp zwB%-EsNXYGkWhf(;R!&r-8I6XwwG|KEq)t|Nu30-bjvrC(qAw&gk<46sfaK~SZH zc}dB&=S2qh2NaFi?xF6>wJ>Zo9$xpZN!CYU^1nvKJQY*VEti;c_(BxSh6!;St$U6;8#dkf7vUPQ-#mRqA^a1NX>eEpj+++!^S2*e)!(|oNf zS)oj%@G!AwX9$jkwpEN%*$t3E$M58{_yGX5Oii!@|T9Qhq? z$Z$%6Yv6^;l=^NF9B_AE9YMXmw5VSd>f^5>HJlqRr|0y@Qv5~8dvU=ibYJV2yJx{)#jX0gxcaLm2Qz1{05e}7l&=;k& zecGNkIIDpFPbb=Hm5a6wzFAs#cR>)lr~C;@eKNN}woB~=7qAMD=mh2)nvM+|%8$5`YJT{qr%AN;pBfKmbJN5V0zC zj4Z~3O>vR8zn|ga_Hme(Mbw;uKGwY47(5~{o-da(`lhy;XQEFrCzm|gRn|mvmUg+W z5#gf`+>NaGz!)kX3+#*Y!;bGj-pUE8t1@r`r$`Evq?(aUS4y8tz^mG;tq zBiHe}lU;brth&RD&hjmn(P-1X=^BzDarvYgq5pQ*4KB;JS*2j0ODE$^S>t&4-Ws33 z7GXGq5fp+abh8Ye8!5j0Q9OuN3_={3t247u%+j#mXiFxAu+p!EAj5ta{*I1vzw_)^ zEjlBqXPu)(+zM+^+2U>dv5akBN`!~$vrrz(piz#@TOH=8U%BlSqHd4iLO!FyBeve; zHouK}RAn0|oR`@*tWqJiwKL6zp0hU!+J7ssAqCO5RywninY#WChyjH?-UL0|7YTnk z?8f*bZuJ^xKhVz%DLpy9E@>=z)mL9UHeZgLHa`afmpTu_eyqWR#b zKf9wl^g4N|lEQzraWC*`?@cXlIKEV?UF_qq&Xo$6I?403LA&)QhMuIrc~5VYRD9@f%8LoVuf94JNrd%5sp(f zFSIT(zRG40j~ZDqo;qGy==@?2Ae^FZ>ir0Bf`(N-5MhJzQnG`&`=nnHw+_W&^(O!} z=HZ|zVE*m`Eu1t1GZEf^eIpk==zO3&>$`fgqU~O3^x4U!fR#3t`R?+rVPU9V9CPXO z%@$sEq8tTNcYXA3uHY;kj_>vV(U_~mIV-$M3OS8Hyjy-D_yC@LHo8HL3=k{Gzth<+ z@d_PSCoDKvykdsqghmZ&m~w_+Ktk%>S1~^s;Ir=o>VS%ELVO}RQR6i+fXs6oJmceT65j^}|$ zb}wVPs|k*7&RCZ#g@h2Bj;D6m4+u>P<<%g_eZe$9FNm03!9#*6e+(iM6e^_#tO-Qy zrYc=L;j-IJ1b#hWd3SnyV1$gz5@N3W$Zk19&K7(;Ee{e_CHWr!qqx8g@ zyzHE1SK&trkQeB7@!vL89)pxn_TK)UlvuuI({&W{lNKz<>4u_qSutYF%J>%}9;n(@ zg=3Te+w0eD6I#N6>&#cc*JWfq>Q1$lfQ2QLvvb$KVz(xegd6cvdwE^lG$L9;zY&-N z7ol{!02x9JEJ9$$me8c?g&eqyinaE|wGuKY`wS#=P8=r73V-&Lb=#kfqO4Q73q;X~Rq_o5$Wf}f6N?->Up3bk! z^%b}elB?#vIbPt-Zd zkDrFW@K@%wpAXFkaN*I*&`WHGteT_q$>u4fXkDn^{H3v=Hfqazf1<#$oP5Lo9?fe# zb8So{jiNvgn&jWszX3DMpM(v$v7fxHUZnJf549V_Y93 z_t$4!)9_?YspnYHC-hHHSIIPhxffFk5lzXA zO(Sxd3-O>~;0Q!*7$pA|L`wc(HUqQbMg#z&$zOdSa4`7yT2))`hrJP(M*hRLJy-j? zsF4?g%wJboQONZ?djO$Aej9LEw@r3a%?XN+njlac%YAtwrjcf+$N2cRP=;A}#iGBp z`JwLPIwI$F*OgRc*gHqkWgBzP-x|-!lAh#vPR-zT3^JaA*a`H1g`u|`)$NhjsZ*R7 z&IDUYNFt12h3h8F&e_UW&N&7Uh>=7LNIs2G979Pkwb4FdIHt!&OTDq{)1H2Og-czv zIr2@1sfDQeT3xk?x9{}7Ro;y=N-v<>QY+xda3OpU{C02p_)2;#MQHO`R z_QR~DO=H#4d1v#7Nie>m&@BV%G!INR`tOn8wTMRh?cebBP0xgf+&KJN} zY_!%3z9J=(+BkS?$vCKGwL~Dm>LE@rjldAs8RD?_qqjz7WLmiljvN zRW(nHijOuf+*d*Db+1wq@Wdq}=tK8_ZN0v#g!aZ`PWe^c&j_>K`r0LylsVtWN>t1bCip|HL_=}q?T6! zqbF0Q3#JN+VcYms?4D|GpAag$Y_(?k8--Wv1o670K{F~q>+$%`AsTy5))){lj>kSq{|sG6=*vTADGD7$RA?S*dixp#K4D@O07PEH$O+AO(%aA!oqRY6I9lcn`nLTOlC*_}2|Js$>7}CNl6B7P)F079QvMpEn z+#fu14}SZ=`c_RvY@S}b-J|Forom5)O2$oulcAFdlf3ZMIUguPP6?B+n7)!tAR!l2 z2c2r=32yYOIt9&Yg~i&4jgGO%!|prfFQ-P9HX&|{0a@?`ndyu#hMa&&(og<#mLv`6 z-0`YdlX5DCIFh*3MA%{4Hbgk->90X2fv>zz^87;ASGGM`JCFg6Xn23b90xB!oX}tY zZhg#lsk`&5{O20uX#?5}Z)`{2S{7EnekW+}9%AGx5hND3_uMUJ*XWD0)oe(+8lh5S zuPwn7o?<(E3K^HG#fxzozLB=jn&feC-1od+(zlw?_9vkzNG8Kr|bCTHhWHn z6!~F0rOM=`9Jd>+dARhQh+u{viW@bcZ9MgIyF4R*TX7-5HF<=n&e}P zfLg_>+?(B=2w{?>7Br8?2)g3R3|#j2Vy@u)M|$X#>(2Q@a|A^O0PK9uGjoQ{glAea z!j~MXf=0#)i<@ny>!Yqh|9e7Wy*mh<9=g$EomMEoG!cS|>mjb{z|RhJ97s9qbl;QUUsPH7$p4n$A1cYW(oaqHrF6GiKHtr8uAVsRZ!tC zUkz$L18cOTt_{P|MkINW7qt6Se5Fp<3pTr57xYkRBTp*@PnP+b6RMr7aX^b12-6pV zLfbjHXd5?eQhvI}mgTV!(0PJPi7hUAlwmZ5$DCKEZH$zv3Xfai8LI^&Gvg>sC9+cp zn3}Z16xvGa$+M7g8{kZk#nbmN`SMoB`cv=$EodY) zdnU#4W@{$RBk`4vRdo-rgbWWd^q8x^R84!~b-&S{Ld?E`P(O}%!!EE%Oqt?ry8bIu z&h`rd>5`&VplTz|N+cht2v{wBYYqt4oX18`EHR^UA_ED+0x$%V#wa7(X>S0C2P`nL zo6j|b!>QVZxQn=}->Ph|bE*rHbLmlS;*ZNU2M*KFTxD-J6x1?bI^K+GRo9PoFbapw z1`eow&7W71Z;4=|rgmBxXYu7#)}62!cSY~9DJtZn@_0HYaDw~chnNK23Ki%Ifk1+S zFwho>u&vC8xcJ6A;NV1N89Yw<(ZWOY!McT+7sJN(*f9MJ8j7p?1BbO)a#pn@U69*x zK6KpNJ&&FsiGV~d4j~XMB`MPY>QXoZR82G2#)p~i{Sbievwjt^+CiSFntMcsO7*?w zf6M*jX41j-fwEjFMSDeLr5f|MZRiy?-eR1f;1BuPQNgV;-J*$h>^5T_v>0YOsEz4v0oW`E7~s6FMzl!EPcKG($T*Lp1mvX{uN3+|w_xkm`6d}x|E4;pslJ>WYb z*I9wfna(jrBzQWor0aO;pMgjKmxamQUX*@6?;-C4%Ilg3KyqTphKifW zL~id(MfbdwnYAqJyKXu}!AL1Huz1OWF8=#W4*e4!@_5uJVz0?uad%O z*-knNv;paMi%lCdh$=$J*YRs!5+PYwQJGPUEjosJp$Yo6=X6!6Yr+uhA?e%=?ADm& zZhvRcNzY4Mnug#R=@f-r)4(Tyv?-3wth?Z`;V0Eh^35NOeL*$E2M}=MIpqs<$I!x@xWDi~J~pO54{V&O zf4AY^*ovo8-FAXcYnj#E8{ThvHVz;T902PQKvl1*(dL7F%OCVTZFgylP_1fb95*|- z_S@DpULju(x9w;va)V4*3*)*C7kP%E(z(I8&p7QtHB(;!_$H|dNGOP5^9w~XNf+uN zOs}-=^YeBb+iduRUbkPICx1;kQ8)168kF%d9FQnw6LF}YJx^%M7Y4WJdU3-Ytp701 z+Lo|RzyBq@FZq}PjGw99P0zoZB2!1kWT##dg)4sWYSb*MP}SN01(J z%=rj@@)6}?uqZBY6-?^Nr?m=^$0OiWHJL{Ce;#{<6w~@{uN02|FhmItf}xAJ{O=i) z`=8U*s#H=%v`O_GL{mOqVU9RMF#df_Lxv36?cZ15_MMQh{-1un#FhwQ^T+7+t zJb;|{Qe&czC1Pn0hrxf;#NMhmKH7L?h6>w1GjX2!;h~~&k3$@KqC#y@r+uh2T`c-Shyg?0HF>^eU+^>1{W*?FPl{)>Cfk}TDnwv$ z>%e{Aev5drq1ts){K)vm){%>Zhy6}}Ue9yP7xFBY=;(`KX2a>NTpK4BTFlC^ZY1q7 zJ2++ewn@)%{MXBcPzr7We9hSAAnZHHvYIhhZ;i~HN!rs|_cyCU{yKm@!h7PlUHDXF z$$|R$udbsAgdf!%QL#1yqIXa#=3c_G$6I*FKbDmzFaK)O7EV05CnbK}OLL(#8Fmriy$O|(Db!=deFmtbw6~;eDpII7SRdrm#=QB{+pkpeUR_$pu=Ht7- z(z*R`$TZt`OVdZQXGHVAUSmd(R)BXGO3FMQdxIR1G&N2~DDf_s1}yT#4*t38Q%!HW zL8Euu2Pf3C5xcit)i4VEH8fJcWnmzLIJ)Cp#lbEKlM4ulXh zqQq9pn+h6!<T_3qlQ-j#vSi-P}W97U)3Nj|ss$C?s>#a_|G z^rZt`QC!~n)b6(0B$T401kDC?;93>JV^YT_k?GuXv0e1p;Zw1kiGPXEi4{1!l`Ggn zje`XIj0mgXnsGW(?5S$?YCw9cz7|wEF`2m_PEgK7odDVG6XvO&nm%<$D@}2xwxH}x z7SZWR$oapS(n4f)2VfjRF6k@RS_I?lfT@#XeX7&T_-^Z`D{7v=H#JPyKF|WorE3G+ z=r9C#ePQ9hA>W^Y@wWsAjaC|$!608ks_a>CS)vniD#*bks~%y2$FP)HGJCtC%K6Iz ziQHBx{9i8aa+$~R`L_|rj0D`G{TaMA8SrYq0rsz3qSyzSH-I0Blu(qcZ7S^mzi|>3 zQgeD-9EJui9J8CHum0{-=hfL|znyM&`#v4VYcS2~CrEua&2VLsf*}lUF;=FnUxgqN zSBi@wh!mb(m7QGwa1Ie5-y%tbv^4!zX% zmP(A*CdTR`$=+mdo&QwheZ;V=(Zn9SC{9+SeO)mB>z|TVYcyZGF9RDnUd-KgL?Sg{>)pCP?(a|nICPCc zv;=o%S8idye<*Bjjz6u3Vha&3$4NfwSl_VY_#Q7x+LJ&V>+hXB5XiOjVv zM~aHwXDEo%Gv&6TQ;@BDcbaM!lJX9GdmCp3tKGzaxr#`|kbI`Vm39^KC9L-oJ#^e8 z^>*Qb|gXCYIU{tEfGYal(NGmmIfOnHX7If{R?M-H>#Z}9~ zpqDQQ8IUzf)0v@iju-Hf)j-q#`qkYAGZ%Jq_B;gy@zM*B#my3CHdn=Hm+wGWoR?{P z_P@eQ#1F7*d*?gA1}d|j0+xzjd6ZeCe)Jk>2$2io-}97HJ69b*`7mh7m$Pm_lMgbh znG~k~sssB*C|)I;hvOH&d?KeAck~PJ`{e|6pL*ma-f)g7oRK60OSLpMitX_iyjDPD zM-ZhdPjEniyNxUriltpo`7N)y#CjQ*o?%kia&PaHJ?5NTS@-4mN5HTAI*?lvxm}SI zL{;=skIfk1h+Fx@!oh|Wgxd87DBS)xEVuxfVo#GV6$qW3FggAf zzS#Q_O_D`7*0IhaoS^>kiD9J2*{7UYmvO{HqwV~**n$}&G-NCD6izADLl_#{dDC6v z$qr0=1^{GolZLO(kMXd^!Xam_S%t#|d^AgwhWvG+rr@QwJ~$~y)7KrZWzqnFYDUom zL)k%bKHNDVBln{%D|1PJHM>>tiuD*<-~uM#dx@H(V~$<_=chVS2Fj&|?L8h%+Xku| zMCjf&siPw0=Mlc#)8{*3LfoswFv?0eY(6k+jbn53lzQRFtN?LCaU6g{t~m^xrp;gEYI=kcKV>IPiD9yIAvl+)~a>V(!3X@Gvfm(FKE_}HNYx`gCfG6eQry4*Z z{*NZvxrzWy&kIFK#o$5`i|W*HYulPL5aYJQ>=CD?##(pBBF)wXmd2|8mfcrqgCJHC zKL{!bSbUP}Amvlc{&%75BrEy$b}D}bSByjspDjqpDEvv=^C|CjvXWm2b$HISdQx*RAuCvAQa2QX4-LupXQ+Af49M{G%D!H3Ge1nn2NZf!eH2)pzb!xV)`MijFO zPD{3vq&|J%$mC@ej2x$aG(Mhjy%NUo5F#{j+2Eqp8#^2R_`>_$_cCUS6BZNS=vVJvQVf>G!Wa2x0u5p6_Ch3}Auh&cWD^U{#%2s2lJpgT zcs-fo>sb|<11u^DWiexm;*2JXoMJ)tvWs#91uW2lN+b55w^l>yV48&pgCe5CSJ8F{ z_SO@kg_m|AM?rH(LC@%VIzc;?d(FMy^OGQWEE$Z7ub=F>bZ1a?~?Vo{n z$C`iSVsgUbW#j1APR|)xDc5rULl7M(mnSBu1AxMtRvM!ou+-z{Y0pxyoU=Eg!}8A6 z3p5^u=SMt@=$`?rF;m^a_vdS_&w zl2={Y}XBCEvCg*_ZE zrXQ=Go8b_Hqk3D{fPRgVORj++h?v5cqQ+ayubhPdNSWAaj9 zf>4Z8WK2t)Etqu>4ba5-7*)5q0yNN4>vBqi3prf+&+%_E4Q1>LNGdp=V_t6K>swE! zOGv`#h+1bdr*ovmr#Up1y-z3lYDv1XGV!mkN2<(4;5j^j{7Zmb(@j)3-Azw|qCX}; zl}`YiN~WtcuPD&%ab#>Sswc*BQd5xwHBx4oIS=v1$|&Q-o7s-b^Etcs*QGL*r1m%hHrJ}qUtKH!?4QQsJr}& zUD5{OAFyc|jiI_v3@&z|T8p;)=!j7_0qi9+7%_>iKy4X(n}cTD|Ggf^-X6up_N=Q` zYMVOgl*xCZ%&D7ImNMYbUMzve8w%Ec9sttA8Q6QFJYDYmb#o4__X`5B4UFY4QD%}* z(xo1p2&8jv!p!j1VYJ1<GPFA2C2N8%O!tDL{bVzm+oE~% ztuAX*283&A(+IuSiMoCr5zmr@8ZX$tP+#__nFYq-R>^5JuCzag( zY06edQ8SWR!Le*{vYkL$T^iEMiwdETJBAKKh&0^TV| z+*lx!q{BkWyvqOspw1-JzFNua9{|~9X`jJ!RXnQ{e<|9bXW~3hk6<>C)u}mEL}&Gb zU!DB?#DKVG&IOcz^R3Z~-T-yvKRIVBTk>68Ef2ZUCiz)NR55g11NHnSVdTA-@wj6g zJ!J>2(STmgEyGqVKSXdClyoLM+3M{?$(1v+1_v-ozLB9g@cJ`2pxG}u-<3@i*_gHu z*&RaB;%;+HEie3@SWh}+8UZvo1=||>(|z}AQ1CDnaYiOu3tYC^AeQRjb*;rjkc#V? zoGN4ur<4gw))oO}J}zX5|J2?2TkRG&%u3T3hpq!g{T{4Qj(VpZi}cfj=>veVPU)4_ zEXJ0B255M{Q`-tLh`o#CqOV9cxHAsv8M^>`NBPxMI4iW+RiF5h*^PQivV$rWbCIU} z8d_p~b*k`+ct#l+Exj)GDJ}}$La{W-!!e~cW#4VoRpI!hq5rJ8D*uf%YyrR9QA%{E zX(_P=^sAt}V^52gAET&L>7MX)iYewEj4J;Om!_H?n{}oAU8$_8B%K#DaQN=#2sbn;znHAFgG0j>7SU7PS%=2MET@z=MeNd5bc>#))It^b=r~%p!MUXY1wQuDM!}}kUQnwAY z(a1+|7_ulrJ_2cnN5WS*q0F@n7kgkJTVo^2B_^NNkHpfS-%b}OnNQx1*IbyKjF8;% znL)6>MXblMzQ~h1Bd#5k+rmWgq7NrD%5zMtPSOf6mJGZ}Wi11?&h;H+=|K;&nsk`{ zXqqcFwasJ-v)q5i0oPg!zUc!)&h(;!Z4L9!3hJI>UJ06??`;HMWNj`VL!dGL41P!~ z!QAMb?yZ(=rRne`o;He|o1RViInFjbS4I$wreHUpeO?d4=6^E2tO-KE{ngb1uU`7U z6|s$^Gr64}Y`V32RdLEAPh?v)AjlWX$T*bE9R@PH5fM96r$N7Z3Mq8akDIAc-2+gf z1%>)xmz`{bE|9twmeVW(J8=0+!`&Whn%?j6hQo1OKB~loulhW5}*vRzK*E< z4CBoV1rkdAu^*Iox1ksXdm<$s%M+(_@sGR@Ishp2@Xx2rfaY>4!O$Dz1XhAE0uXjA ziL2-+Vf|0QaVXZZ)`|R_H!uIKsPm7LUo+Tf$N^TbGYi@s_mg^IR)hd0_?g4LP?)t8 zR(h9d#YIL&@EK}IiR8<@%iCf%Su5~XLO0(U(->X_)v7oaqS4NZT8NjPNMlI_w~D8mlLCV&HQNSA^U8w zt{>rKy^{Af#k~C=X=E!c4FNM-XnVQDi}fglqfqnEd3&QT+HU@WNha{&mA z?BPs$*L0vo%f`U4`}4OQyLf7@S_2EPj+_Xl#73VNr|u~>$bm6omfy|zw`EE8bq^jp z5jH#R1!5KhWj}o=^iMvAoRQB*=BRwk+YC*KLkgt}{WqX(KOg)^al~qjNRL zZ%s7|8WlqOUby_F2Ib61&2SXsYh?FJ6*_W6Krm$uAKccp7~n{=(sV;D!do_-oEGHs ze5Qi~N^}Xjd(vLW8ij{U@;#s+S+1$zxX_^c-F{#xNIKY0mxUzE4T@?EA20w7OE3Ui#A7@L<7FaQ<_B^IAE=YIc4?Vo19owOsd0u9Fn$<48IcGGu z4rgz5jT|x7KP3kL+ctBa$9lLA|Na)oBoSfI;t7BT`DjSdMH+Jzmq_r?`R$d0`A^lb z_c&6@iYr^4Z{0dXG{m#E=yP)t6{7Drh0(X+u$;{!5UN3g;>c<44O7Izk&{W^ce6W% zhyRE33OMy)iKn#WyQ11d{$w43CRr0W`*#Sdez++NpUHU#Thg%5OzI{aV;(FA?}=FD zhkZNkf@^B7WY#*XJ3B%iD(%WuMY-kC zmd4^_8)DA6t<{cmr)s70_gNh5Lmxa?t69k+w3p3Z2awe;#E3Rr zp1t0>?z2;*X)M~M(vLB56;Iohd}kJAmzVU_R`=!XB~cPD6z$xM`Zf0Xr4|m|D1Fle z!#tbkcZ@5}=JMrAU}jbfNMV~LJQmIH%<}Ohq`3I8mbd(2G}*HD)sXhNMLibHHB11R z3K3zbsbF#uO-!RQr15EmITB5X4J10aZgs5#j!m^UlVyfCdUQBFYP*3!GUM;G5 zWawqcdi71@<#qn@TOK?!$T4?6b9}hYU%8+KknkA4v?Cs0rnIiy#aBm8dD>7I6DErE zX?pZC?It0`Kcw|1#p-DY-7M}nfHYR1L!93~gsLiDAMx+d+_sA{U;^eqa_l@~CeL2j z$N3q~t&ydcalZbQre*D*l<0o^iCtdSnjU=L;L{9I*ZZozo;Ko;!Vr~xW?5g2?X!+S z#E<4IxMEr8{9yMLC->Z!fMNV>$YiJpBDcxQ-N$Csl&XC}pLD_mvtXIK%_q8NoX%W+ zgNg1AxLcYhm|Mq;OyG@%>dvuhIIV449BtDcX~p5KAnM#Sm?f0XaivE6=*P`#vB)mw z?l;UjzUw9bvCz0M1xY24(qtXlwe(aofhsd6YpDdVSawM=rvk7F{B@VeH9~_u`6_t4 zl^j4e4Hn28B0rs^+Pxz$P)Ee-zMvp*((h-93cZ~eJNI{VpE)Kz66|H-k4gnEPjtT` zF@%nFoE0m!Lk$C-xSh95M17UlCSC~Xd{{6)`kG|^i9>#Y!4gNM@o=D!kGso#w-)9> zkF)U6&s!^~!Hy4e5{}iB;TV@e${NIc#lAW6 zPyOz|XuK*Pi+S3LeU6t92x^D@2Z(a5&7)Ku6P!(k-!HYIY!SLA035Fz*g3?zQIpp| zrvGR+j=@At5`+)2BoCYkwmfU5MsC~20{;8Ks2_E};yR-c<1{u;P*0y?%f~q)% z*{a;O9jG_#{q41nJ>{w9Nuukf${|c>7C9Q0eKyjm?zy+C$&?~7^^F8 za!=XO$0CWZFv+6ZfMP6=#UwI|1tWeN7{x<}&Fqj5_{{NW{p%#6@U8#AzXzzjg&_R9Q-yBGVP8W z&M8|7^TS>O7GeU~{J^YuX+6iy=?F9*Yy1w|zy85a;Eot8gZoL#vYu^RuL}{*Y!N+Y zYsTAZ%3cao4x{FnM81~IGO+)0^8;6BCPq#IUiU-$OHb{CE!6|0I4q*A#GQQJxM?|f zHfdpn^vHZ$G8II{(jEX1^Tbaqz|X0baLpLtBwzGYk2wpTO%*)|2ER}$;r=c3vs3Z6 zkLlI)c@6_>%hOsFlyo-5Ff8|*GVONLFjn;m52)h?#vUc=RwS@=H%=_t!ZJBu`Ag;U zPqzu?OP^)O##jvwKszeN3m~f?afWMb=$bjNU(gr5fE-%?@p1t5WkUp; zKmY%3N?HRcL>qeL#r$_n6Wm(7f5X2N#UWN?(DB8 zLYj^|>~!a~?<8o@tUF?nn}3R-*n~a!{xjtgNmDG=%><5d2OooJUm3f%5}Db`z04~O zGhKSw9i0&G8{PD5h#b4Wrwhi(MB7h|5Qhk*^QlE~WUNwRY8}Hc>Oko!ifT{Hrxxo=9bvD}Xy7ZP9dH(@ z;gJ*qGd;Bvp95Vu)`-0d+KzKr?OKLh6ce_KPf7UC#ePat7`|E~4)YJ6Jzn`h6mt=3 zsKSW67Ed4)whmn|ryH@hU4`O~|Hlk;qb_Me62h!_T3@$d+9s9NO8kAy6D}!Nxh&;jJA(gfhH*gCP0y zkzzxmyt7>(uWHZ%VNU~mP^=>3NdFW1iy&NXR4SD~1MEq3Oc-|OS+?3t(tAV>dPp#z zpNU!pPCe)|KBTJt$7RrO*2(dK;BGp7dA^xY!DlicA|LLqdgs36uK>9%L^=9^ei1c! z5h=9E=!v>91U~dbGom5eO(X~_*0nPOQwkdAmJ>AD@H#4SrD&qU9xJ|H6?f-zBW%NC z+uFYUg0E(#D4(8`Kw|!6psXjD#u8yk8{MHJyjWKtAI?cXCPCX&sE^WkX@1!Twh9H< z7+pZ!2{hRrsHchhlP1`f*cR>B#xNs|Iz7EdEwN2wc*bBN!)yzpI5C9tsf*^utP!A1 ztw99BilyaDqfuf8cJ31+2CQ#I`VdWo0O_i#S4cfSgC&tfQTUh{McS)m0HU_&#Nkc6 zB7=^J=Z7!MQS{HNHQ$6n)BSXvTp68@BJ3|w=@FG#(Vb#2ai&CkXU3!fHw^-sv1vfEq7w88E5NaA9yWYixc zSg|{CNS7X*%=Mb?7@VontI9!}u>!XyLT*MvLh?S9eHNx;qa6i!U@1}@<`a2O?C!(h zYTg5C`a4_Y6ND&Z0ll2^Q=DF-LWL1eIm&x__G{J93?qRKORg@C3a4|sl?CLiM8EG< zLn&kQ`ar51`}a+zn(%@(A-{BA8{9z5LtPz1aA20kcI|9%)i@lD>h}8<>8euRr>v<) zp}hVHUtmEBU#IEm(S1Prf)Xa`3rLAs@xw#jA8$8kS7HwkME1*fWu!iJ9Srr|>Y9%a zIEve3YaZen!;x3iisw2ZVDA9Z6;QpmKx#xA#w)|v%|ghd_K6Je?V_N9PMFR`nzbMN z_O&NcT=f_;vP{OaDz8H=Ng&RQkp5*#ZX7HHX%YQwuOr+TgJC!mis&H_L?WA~o^pq{ z3KT%9R`*5gP*q1AF}h6cvGB3nztTt;%8014q!&7S_nuhmCdq3W=CIA9NE=@fE?(vH ztNV&KJD~AQLx5bwQUFJ^oH6IKQ?ZMQ)%GE!9#43(78B~699Poj<$)$QVEH3Ffnm4X zK_SX-^s)<~UR4d-QcOAfM<@%*OmO}F9@GZ{LufFv#7dieXJBD+S8U?IF%Hk@8qw*g z2A<#9w+=Lr`XE~)Rq8#pNjp7JM4f#`=)w{fm6U+Ct`fasX{IDO~AvtzfXk{j7Z7a7*oZ zfI2=uim^(u3%G8J7mHL?5#ZV9U(>OztWJQjA08^4x}O%32Eti1TPh*$i&!EdH6Bo< zK7Kj@Kym+Y%>2x$h8JBj@ulCnpUmNY?*=S~NFt6^@!UZ=(A$Z?@K;r)eus3gcV^U7 zBum}<;q*cQBb8*d0W|{xWno-aE6z~ElaA3Is$f>Lw8>eol?V*xEZ?XQM_Mw?fn#(n zl`sC&Yl+-9)8OJ2_H!XNh{)2c!ZOI{bf0xtbboTs=nmdFUf1FFy__2fJ5%r+&uY`y z{3*mOo4!T;U0sI(#{mmd2gX)!FutT}(2dG9Tjc~1+1@6t7{MEMu%kMA{;EgdT_hPPD7(v{GT+Z7qY}8ec)FsGoK6E zp8tb$jOkhU;~K~wmuX^Oy*D>@f)oS$2ePkCdM}FShiqigj5~)E)ou*oX6Q&xqlrcek`c#;S?i z0J)RonJP=A8V_NSQZdwcJ+GPhxsfHEG_nHQ!gQQL%70CTx86n|oGagN4dmPX($MkX zxMf%kYozklVh@DgQfT#N!UFGnT-={;*VkRtswvPaz>i$Q#%I(X3Iq$=znne&3 z+6D)XMYF%Z-IOGy9*kUg=DfPC!D#h@^Z+PLe+%mS>}t1`^XK?0SIKw*otcN4d$E3T#&tv_TR zR4*@{T`D-cthSHKO^UM3sYzw0CH}`ymmuOP>>*^E@MFuzuC%cf#WlbG((4xt_O*7Q zGl8wR_Zx2~onqwixJ2t+Vfs<5oWRpOev9UVD(O961M%M=dr*>I8c>b6@Q{zg#x<8g z8?*dUpjNjKkFOdcG&h`j>KN4#lFX$wj+N*d*iZ&w9J`ZMAp{p$=~X0rsbI%C0rDi= zH`-eUprSU=913+lG~1|_Zys>ehzzi}GW`m3e7chYE28;+)~;#aX!9A^$e~cG#0>o{ z(&GK9frG<15#%VIOIJ5LfLDZz{cCMhTYE6&oDZG?hvtO1x*X+lHU^|M2M8=6h_iat zp^Xg$6DH|FTCPj?OF4l1lpwbBXA5jzg5V>1K9P#U~^7B^dLzClsIk5Tw^3tR2&j^bWR%}Xo7CN0n ze6uSYE#C;C&AJLO0viLEN|(aOsQ!H~4uX&R(>xcP+W!48Z%xN>tyszBP^JJ2`iZ0H z#sWxhC~0|5>WWd>F(;|$%X?&1Ua}8DAXSO{Dkp0Mtc({6ANo-eg^iUvBi3D)w2jgMi5i^j7KRE<3%oWHK5jiPD? z%TH~}i=Q37?NRgnNnMPCk47BFj(xC|LM(ubb1bg=pT#NPWsJp>EJRtsWQVgwUpYup zJ_e72QnN87*RSAZiUhc=IMqX@MMt)2skJQfR-~?ouF}{*i+|{Cl3KRc#%N`7F6pMP z=GwO)UfP1pNt~%$*x1?ouhF@iNf^huEq-!O&v@lET;N}`RXiQWMIpdIr{8x=g+<3T@{|wkWPj(&~MNgD?xZb-gz$@v-jIfD9Yg#k9?!39Ip47A}WwLkH)O5|F z-_qjOSqzKDFXS3HPAk~5$966ak*}fX#iNf@z)nlHFO?G|d*Wr?3g1m(Th}8%L}yEw z49-vRA;apT=l)!-oUvKsP9rp3)`x@qUv<5JP$c-WX*%Slub8h5x9$!<=^u+jKOzLa z?CR2|hyJeKC#Zd*n?JdhrBcAv*o5paA1n8l%cI;T&j_{y=XciOlK+TG_>DC4j_StgU{5j+PCC)Uyjb)-y zSXXMeQWCAiAJnF2cmt(nuq^j9r6OETG8~UJmJftvhj=4kEUkfm6QOJR==Co&F_W2m zTi3*lT(*6WyVYdG&g`T>Y)#{}^RjBGm_; zXjm3+425bC+JphquYME69}<_Vs~)Dc849Cmd#GTxaAqO2by1TSM01vS?|T-E_8zKi zDh&wc-OUcT9Tlnn#^-NWo>mWSd{wO(I4*B}$+a@DO;-#J{ z?PTx=g+vs$7|hOG>XNdxn4XJ899T` ziR%~|vqozU7~Qp~g)*a}NI-@Q-s0Bv#y@U`(;>KzK%ru|+SkJv~C$6s$YL zw)IB#4GNj*XUVpW?uC1Ag0xvCXV?937a9_@F%x&Ka4{6-+<(N@Ugp!e|mf85G!$LLe4Jmo0^qlX*jR8D|GaCE*^Ilb>#vj#oR zNpumEM&(X%|9sXcRP8dpJFJ z#<|#GvwWGYiAb~qIi^(L8KdNzzB~|lf8K|wGxO=r00Qptt+oAV&2gK^Ic=bW9hMpUMq@>(GbyyhRNQRj|sOS8qwrWl_Is;trL-_wi zlE#cn?r|k@L|R)!WqMiB%}tiqqbst9;9M(^8K%~RGAVREDG@7N4=3icf;dVKe!|?U zc`X+YLv#F`^)G3Qk^Aluo)ZQXXo_rwN8YuDZFrw&9z}c5&QQ6}fc_B#Jq&7!sbFb; z{_B%G2S?wJ8zs~vm0{~^5!+#G*T@^Vmo31RN&P9`MCLM!8ES?cChY-T2$nIBK ze7rwWKo&JB7d4BUW-k&b0MC5qH8=@}^r{Bh|xLS2A}few|TP!-k3jN|wxG zOktULV^CJb%+kyq;wIUZvqsr0ym2GZ|@ z%xVw`7?;da{`CK=BMzv7xWn2vu<4< z0~ixrDqBNH%`hb!C%w0~=$j8jVrD@?d!Qr|N)6YyCLOUX7zwM^KGL}HEt=em(+Gq* zNblYm^m5EY&wJ!HJ<;ws{dWy?9C^(PJ=Jixe@Ey?+<2jEGJ7;~Ctz?1PG*sLLdvph z#j-d56|xS_cA7*jO^zE|PqZB-2O-6y)KA0U5Y>ElrAp9{uH^5%V6&)ZcV3b>+6rvdZn zR{Jop0xdza#i@9iyVZHZ(MKo6O3jk_8YL~3R^xiYw}}spj#=)+#$y4!%p*9fWL+aS zAnnzB6N!;l-@>2xsB5lIF5Z%6{x3ua%uZb3b4y>`-PBY8ZKCnmWod(KEYj| zzFK`A=6gt8Zzz%rj#S`4xF;Ci9m(Pd-j8TFaurJ(;0Sm`QQ>nH45lplPYW&p_g^S^ zR{r?`bp55t*-*`|p zU*(n2?tS`bpeTn9zlUnBhJLn6GG2&N(3)gt^D-8QuE*O;2d;1BXx}kOcWkq)VaWH^ z$TH^jAa|eWAO=6fi_)ZbkvujYiVj2npZC4ryP$!wuk8XZuKw=+oCYFL*0dmK^@Pq7 ziQmtmTI3Xwe*#TrxZW(9W2NgC{olg`N;_$1gzju2AEdkGBGkNxBKW#cc3Dw=CU$uQ zBQWgAvH2(^pk=5B#6SV9DclW;&`208o7`%VI$FD*dWj`tilGAjqvt(1q_^$m*STvC z0SYiCcsKeS6$ttIrUi~|axQ56o!~W=^`^MG1=$KyG>Ls3T0%U>Y%@AH=>=nwLWOaI zhsk1K7sKs5Gjqrads=b^?)YW_r)>PL@+yYVw;~h7sub9hGvvoaAfD^Qh$Tci`lItf zLR|87tNk|1Wib|ttZYysSWsrs*n<2ssF8CR_*eyoX1&szA7d3Qw0)nJ;lfcoNZt#i zmlH9+UQAU*iOR#+pU|=kEtaiyLj?{G=%9Oh_H@Yi*=oNB41>&L8|XkKvCR;sGMcgE z-LV0dm{%D}lTrvvR|(kyZKAD&x8OKyo#s_H_6T)gwyJ0x%}?A2|MZN9 zbH9ep{s4@WHV~NkC=0EL&Pf|&;)8x_ zza2F1%UpPzHyI5n!?iem0^}!88@zAv4HUjQP&xAD{WMmp8&YTy`*Rg`8lxnoOq#K= zb?&dYnSjW7I=d2Olai-FKi$&G&DnHQ)Iv9e zBhFqjCGQ@&9ULwDiWPy75<_0JRIYy1A4RzR)0!7@6(lLm4#GIi^!a0WsKYR0orm<} z30OP1I_cf}CPFdLH^veIF=St7K2?_GEH;&CD8lOg-=U)%Sq}fBN4QFkG!B1o*N|)A zwnA?qd$={K{OwKv3r95MJi)8JKg?-|X3V>J4;E@TouQX1(hG+c?wX9k`gL|pQnM$D zwSdm1c4a5OuD^pTGu;@T59hsD4;*tqTiH^e{Jb<}Ce{>Rez{UQpQ@q+2Nql3fd2hB zElJZuT}tcYB1{k`lz873sUq~J3X$1VjG#)gmA)?Sra!m1HKxmmzJl~M-29);fRI$* z$iK^`zNwlDKM36iLTuXF<*z(M%jZKJ=ftoFQ*LtM&duTaGUFcBdf48O4bCx>wed5r z%)20eoBQIq4d8Cb)f>OxF0B}Rx!P8TB2wrB3vP+utVftf_BJczE>9D1vJ&cf2-wrTr*axL~BIli+tI@1iC+59Y_;K!jW|wr(?_6bshR z++op06}+>6nVc@CT;Dzllt zO#pPUxnz5eS(H`o{P;vqsh|JU9c zjbNJSJ8a&RkAnxPhEV1Cj}rd_TeiGkkH*uGr%0XdNUZfG53u?b&|IQ`R54IIAs>~^ z{&=b6Q!G=E2f~97$<^`kZxxwjAU4wI zh1Z+09IDK*DNFi;+qx=Ih#E5c0HBn)p;h%)8STv2Pi>+P&(`1YyV}3$5Ytc&+ps7&zsTRNo>~cee7Ve*n;u~L3MiLv#X=u$ z+_p0jzGjljJ+C_Hx)d5F5f}!#z4k!|H6jW2r`$_%-V$*?=k)e0GB*~8CN$?g7`1ru zCe*(X#EasNP3M&L=YnWnO~McO%1eY91L7cN<%R+IpB;g$5o^+xbTv`Q2)Bxw71B%2 zxy&q)Hxv-d?JquOTKHnseXTzA#Wo`bkt|!aCOpH)Iwh01HhTt%LTgZeY)R+Q01MKa zD!|bfAF?nD1;g<4?!(*L>mBcQqS;O`VSs>Pm{DI1_yF@pDJPH!PFkw2DprhZ=r-~z4t~J>-_q6N-2LC}1&SVPN>W0e;Zs}5ai*OMW z(nOr_3lPG@D-SvK_y*|r#{pV;8=gdXeP|o`Ni1_rSRiyeE>koSH;ze#()9BT<-dquh(DXHHKeeLh8sZr76u-VlI?BTTCY)RN zce()!WYQr+lkAvFOy}1V(Ep)DV9Al~Asg1rab(SCsP4WLE0mN*I1g^1jFNMx{Sbb; z@ktY+@cW^C75wj=breXcjS5B5(YZG|wM7BOoQa0or{Y zl;E^j;{#*UozOvk&tcAagbR+@g@nnh2?1!f(&ANc9O+!^%iI~0XZm_R*CI)$n3^=n zv(u;9IM&hntjP0LjPk*Zd;x`iPg)EoHSXl|`rQeex=PlTmX$t4jTXNAOUzP|upa5- z`eQn0JQQHAt=x62*u)4plPVSwo36j;5_hC`={wAb6;B1=ir_*-hs zb>{xP6C{vpU2)n*!KQW&Obl&Mc-QFgNencA?!XxfSzO~lM2hP?{6vl>Er`Xt%!r#X zyk23dn0u2`7}5rsl0U`PhX6t}>FfRUnHfo|>&IE=g!SnnY$9{gRp-%v*k#kvYOFca zk>gn`?;3|+#SkQsWwU*bvH>pfSmrb=cmTCo`2iS)D#ZIwdT zC1OX2S_v_{t#2~FLE1#)wmtkICj!nzllaTchK(8Sq7HOeu;0IWr>ktQB)6{NG{WxO zF_XX8s1dCA;Q2Hjq&$ple{Di^b?BqMrf=mY-VQ=vf|9}$2f7)pe|8t%X$d3pOTx&H zD*8q*uK=&cv1@gdQMgtKFj1A&5e)b4p{m%l-9P#@pM9QI2)0>HSJ)#Pl`Tp$!j-ng z+%zL-wSl?_)9Xr`px$*_m|m(hjS>9;6s#TmfIUZ**uTaL{(aXYMH@$**T#VY)c&A{ za!#1;?}9x>GGWPt8nr8fH+aA4%ynf{6E|mdlISHhuhzuDkWEST6u-D`;EXarqV6or zNa%Lu+K;un&M`^CKdyRpki(e>CXirs}{z_^%ntCa~FWxawUnz_a`!;NcQ6{uxl0JwM_Cn=7wf#%J^31zJ!>`Y; z$KWuGwdEHQpxxg<&>U1c2K-FvPb`Cx0;oUv{@mc&@DnuGkZHfXZ1VD$+Z#-QKM9+KCf-Z~{RQt`ys&`&~ds!a`&|{@t zM@vM@9r#luw3zaV^g>@`MizDZxrHn6FY@F0<60TbS({+dtWpPWNHytKY}1fQyJ#Jm zXgcq0?hF}CYTaLVl&;XgiQgdNsF&f1P; zHVQIKcDC4!UFs|~Ghv!n@Q{!6>0LD9gtJyG`=w=e@nIs9TluDUp27O9wFC7UV_6sT z340bfdc`j9t?}q$f8aXr<>CDj1~Dw*-+DQLalLYr6?B8<@oz>-gZO@0tBtxIQ-e!* zz2=p^%4v^5r)YknHbt@*{nBD);f?0*Fi*^uzkEXK6V%*5Hr>25DfL3lq$!iYed9D_ zx7ZQi?|FQB@O7pW>~eR?<{^MSEn?}IZznqWvAMezEx5Aj$#+w$BO$_b?LL%+0M=c) znI!m{W?N65fB*${%{}*ASq6W+Yw4)eO3=)YiJPmj znZKdU^>pHY;=uEXF(tNdG-Ju^XM;QA4$sGt+-;E}08TeD@9o*sR`8}SxGFYfq|AOE zqVZgeaB?ySR~Mh^{{dO)x$O0A1a*VGEcSiJP9?hg!|#^fEA9!3Oi&eSFhgk8Ru~BZ zXdztOwBblayUpspx0>slu7xR6{A~mq?1CMlse;>St6S!~F~Bh^y0-v6K*7Jus0kI0 zlS9>i&yYG*(RXrcdM=KE%b#R|n6jipZGQCvVpW93-^lUsGNe3`;H6{ga2Pa{5vx>( z&P)uR_+e|mjBL&F>sUD$11o{B^$s;CiH*?-)VL3U+G`Ljs^`>|m?HpogXv?XzR_`d zt!BK$*9w}XdM);mj>4ZOUOZeCRy)xoDH#ham}Qwfj>Fe^HDT2#&#R!Q9M{}+Lv7A> zYO@(zUiy{(F3$4bD9MmBMh9cmCyUz0C5eYS#enTJJW1ajIGY^B+F8zr=gOu8e7f>s zW=aW%wBQxNi%qSQ%K=tYR_gn|Wq++MxOL9hLt3W#Rpo?Gw=%%(K3FqU zQ8Q80bw3Lczn)naauScsOUlIIMR?d+kNvJ4V}diVJ~I(x5ks}X?eHL_`&&DhF=>vl z%4V!bjmx$)c7Hm1;pg=dlTkl2LHVtUp~U6;t$oRjSn2s<{i$MOjcYjh%FQIF76-gQ zivdkA#NBw3RNU7*Orl3IW08@(R>y9xm>Wp+JY#$#f`dpZr0_`Rf;w_UIX~lZ?Txo_ z0AUbD?wwH(Rh0l>?>*5>;%!tY%hiH3+%iv!I9u$qZbG)6)h*PX-ZMiwrQS-UIa6#o z>Vy_nE4s#34Zvak#hJ!l4vx&DNhH7RCH@25sUXWpU~5)Q18ZejJAjH+tFh?aN*kK6J_t?XrW-0YL$*5ydI;!=@^ug` z4dohRxJLsGgH`b*KWdhHKZQ@?95;tT>yYiJL+>W&OR*a5PV}4}FPApi9ID;{Thg{V z&$TK=xvI?4{z~eg4_mCFsjIn_TWsAyfL3DLV_V{)j&%WQX=S$ev_&+iplajsup_iL zftyt38|Nso&TZvjr~1#enY-d;#)JeGh6#tQ$Sch8D0}hjr$}Ao8u{D;v>&L#J2823 z*R|<9YVYymY^#{4?Vz(^w##m>tx|AOwgL(02cGV8#XdX#2wvnhMptvO%S(TJ44$Pa zJcGkJ$M{gxSVg4W1B7T!_Pq?LgPKLZ^hKc4ST_BPa{nw&`KfKuMgcF1}33CgjSE{SGP;kZaMJvzeVJnrj$H^Xa)(B ziVHPNs_bJ5A96i(9<=+G5HQ>_K%f8WiuF?g$Ks1JwyByth6dJ94P8XTD1C}Ta=mJEqa(qJ23 z)th!AvAKIZ^VIir-9hS5n|fc-yE}z7)VSJ~`H}>C?8OTz9gw4VyS5wH!u^=QaJ073 zq77S)<@t{cvU*S+Ef%{w#0`>Oj41)$&h{|n+3;!%=}eTo*9`Fn+2Q12c&H>ayp7P| zg?7=`7~;1k2GII;IwHKQTH>W*ozoCN5YV&22eM7ET8J0%9|i3VO2;)CYC_(JaXp@# zKD1uvk2S}Co7Q!50hxr=my{SH6Q1o<;kKSLV}LvI9*-4+nsw9Ea7vCI^su2vJ)!m- z{XI$Vl<A_3P(kovx|gGsu`( zjJ-na_S3Hj3CKxbr*SrtN2gDT*G|;yi=)Jeh(^*<%`R96_hma+j7_Y5q&z%N?*w7J z-oNo_cHNWs{p^cdIKE)l0k>5;0;ZS0d!$8YL9%U@ zc}Vp8gX84JocpNVqsPo=*l+oTqbv4!94>FV#}xzI>Pv$qs@6eET)||PVs$E>GCpc@ z2j#Hcb&(mK&|bZ%&uLG8zw_3BdH0~n)}GKP8N)r3q+}61tPk8+#6X5x1Fa@sw4od$ z&nfpNZ6QU&xqLmR3rmeD+*OzUeRkAhYfTzGkOkzcKgBy?&J#rmX}MkU^OdZ|jB)4C zL(x;pd=%a7lKfzEPvul3+jY~2DlI5T|BK=l&rnk?^2H?Ep1hetr{XftzWHSCg07)6 zH>}zb{+RI`hz&#IgVQ`yb9@%+h)TsS#@`GmyU%A~a`AbZ` zBO1HJhBhij63FXT`jh4v^AC!>T37#PUb@g*N}HMv%ak`hH~E)y+5?)&rMWO(PTP@RdTD@G`@isEH00hf=C`g|TV03MKW@U=SqtK&Y z8<5~UhUn^GD}{o*eiKT!K~uv6S&1m^-dBS&Zwnp=qPgx9CT`1XW$qd7b!}&*ljFx8 z$2c%9D4Trhm87L9-S&R#QL~jTRE?-|WT&Y0xOm4BdlqKetMwp1)Y2Ma0!5nTL`c}c zV1p`tu1$(|3(HY`8a;llqFJ61D2OYS_(=oL4P~q7_MfTfe3V z#>SIHrj?JYQjW>Ey``08&-uyvjb=5%n1#dZT2}V1pDPFooO3( zpe1T?Ptj%{oHyVHB(&gjaO zHiy_l=ueRgH~F@n?Pu%)e7=03@MrN-u*$B0VA87=8Of*hf2hRCfBRvP6dyFnjO%k# z{TH+IA9`z(;*0Ez_ey9}RCf$E z9VYhg=^M>?!TYztw+_bsmix!Q%jUK~8a5fge1$6~sKS-B0)z2`Z%47D!6FJnd3F*| zDCGP?$#Tn2r65MD=Uigu8~u9CS}Z}BN!decL`b79Rro0P#x=`{R|{KwT@DSIcp9_q z)BtV85Tyy-0gWaN&3^fFOHYYWdz*9gQ$pRO8?xy&t6E3f4JDR0EP3#_FKhuoN?=dO z!aNLqYojg-m~ds*1}$(kjgur!K0P&t;h#zW&XxJpQrKyGj_JTLQp8?+E^p1TA0ZtK zW|$EXVQ)L#vJLu9sJ6Qeo zE};NfnIdiVj$kpMBaB9^QA$kZW9+bIOS7w2P_;~|*|Oy^Izj7(k#B?Awj7Cz2cyPuzo-upxQF`D{O z9SS{|hV|o!I)z`466ko~!Z8|=s^x~9DYlU3^oGvqf7$tAFK`r~=6EuNSc?R5SVjQW zQ;K8L;;$xJwbhqkDU_J-mSghz7Tw=cGvz+ZO;rXM+SI+%I!2d?wsR*w>#L70r;w51 zUo(1{ZSOJxHMv22orb4BY`&Hbk}L<0p&c*4VkUYG8pzOe7;2(Wwbwf%gr+`2ZHg?n z(*QTV+W{?bSxB*JsxDP&m|R1I&9t!UF-w$rP6kP)0lg)%JI5+_EW>Z)1f(=W)I8U- z#BTB+y8OqqlJV){Bk*>neXj;5`7tv^-uH=>Yig4$Rka&0}CxIuBpCc1uu2B%lhTKfeX&Mq}ENz~!}`s)M^` z;j7&J#}}b~k!vSUFN2IcN%8xG`7(h5M^Se+%{3^oVYS8xWmAj_>XsMcAI95Dx;KNtuL?L~!7%%)baTCX^*NnzpjyiIDf_6_bWP>8h1?S-Smc5A>E8XAH?K1r&3a zVsnvRu#cakWhUe%>4_R_cL#TdYb4Kbbsl~j_H5>`kd@pISLxD*dk7-;lJV>Cq5wHcVd;%gYy-UyPdHszv^j)!d0VIEUt9X1$>(W%$cY+dF1&^b*93{PD8j z%QPL9xDy_9HhGW}7@IbMND+Kk_c}2**xT=SQZ{W@&@v>vA=e%SMXgf%?V9{!$;!Fc zs8;t$F!xUL;{5;MF`mSXcIu1XeN6g%jlr!vIa`-ZHqu6-a-yf==xz*>vERjy!yk23 zQ1?yXJ~b2i+<=Gh**2z@Md9z80@GViVR;7f9g+jSG~2K9sg~k#j~0xNw+3aQZCBV- z@}>39JgYG;7H}M`qc~aHD9|X*- z=tjO;O~8bsx`p2+$V>4da=~qHg(=7RUoc1z=#Ue0Laa(nhrsv{&~KWUA=N$eR%o-; z>{!C$P6s0N|A9;VF<;({8jQH<5Bi{GU-{q;`n*|-B6?P-UDO|1O8PNOD#p!HKco3GiOsB>+piR)+B9v zu<-bI9EiA~Mpcx$NYq=K;iQru(hI@VXMt^g`RacJ1%7)D*YtgJcdIlpnm#N(`m${_ zRCkr1 zK7HTVH9cN{?cHgg`ahMs2C(PzCQE}jf!|O{)kkBd2InP32t3$+-V&1B+j-e@GEgiT`b^rc1JE^ z0FCH^?4<*1n;$+_`D=~VwhVzR3ROZdnR?Df*^Z95O=l9F5uBZB#4J=fGq9?>ij1n)Gl%tPmJPoM}XvJ@RV;T5~9lgJ9(7@$^fNwtzmV7q=rvCC#` zKz?AT!6u8aoT};?|5iB^raO59OM^9AXuo0^3z?3^$0h(GXlR|HOgfs0b7f>R%iscI zYDvLNOie0sInKNCoc^&CTs-o;j@T#O=uC5h20zHnJP!+qcJQY{Rfw8(G*TV4*!zgf zs{&B<`jD*Jh_Z?;@o~JqQ!A>1hHSthV%vPLkENFQrRlIft}x+4Z>#n5%d|z9i4)@_ zLXWzeK7Ou!!fgGE`)WsHBfG`WHqKp%zXHE4fRH3NuhfayBw?!4t)x-<2uig%0s(qz zPv`NEKke}z*eYT#J_Wqa);ar=?g`-Kixiv;w*ZCl=LAW zk8Z}m!ZqTdK%4{c+biHi&&(ut{zLh^8QX?bBavajg@Rgk>IXj_e4J;pIciaquEIj# ztp)|HX(^re4|!>^pUTdX>%a>fxhOJ=n=sf^(_UCB3l_ne|3;yjK+yO$D`Quk)vS2l^|`a*+INWx5^A`%jW-RKIkR5d8Y)vd5$aqO>C+S8F#jXEpm7sW zi{^d2G@?1vTk9Vnbv~P(xnbNG0XF=2uKfdI9Pm|*6vJer2iJL;pGzw zg%pH(HL&Z{0Z8Fleh2zK;KDH2CS+orON{@|gZ?dI76~VvNcJ(?VXViY%@Yo*xC&*P zkTozt{<9EQ>?%C(fJqXOu_J}6AF56*GRi$sY6&Itv|qzApBm#G_o$ZG_ykg4Au4nh z|30WI@cI?(E0f5;`9Z6>iy|-aaKx9sEtSdq)$XK+-OJV-r{M}xfz*^hJLCN8bm@J+ zM%QF8x3;y?PB28?O!EYIriQd})L+R=LQ5%qJ(`to$^Mni7nU zB?l;R_;Q{3Lxs;s*Q3VNCA=8mCYGL`kLD0$bz$)|sPT^3C*(JzGOcL=pt9TdXyTC) zkJh(!KX#}T-i&W37lw}`g_D87(!KKealk~mXF)vGMy*#&A zeQ@HtZ>$%K(&6#PGzw)gZY!45!BTdjOg7$9Ou3Zndwc?`LpF=SXF*}q7WnB(Y;<>m zd6qvcToLYZ&4&)$CDctfF$mhVG0^XdRiao<5ci0wk?sT-K{ZX=&Ufj92|T9Gmr2Ej zX)kM3ojJGBq1^{L+yMG$_WVm`S*fa&!^YqLKA>d{8bK1j{9aOBJ?k2VwP*NFb+X7U@`khf zNj)h?7UpN*qrIhV?csqrwE+C!umboSy8C^F2rv~H7v8NsUVm~a zsD)PdrO-5}X(NCRvh_vDpOnXzu)TxG=^W@wMVAADuuX$aRm|s>|9`xqYo9c)v(NxU?{9uU*!7SMFCpVB8w zYxAwakdIP2?}+dkACe`J`pgT@ICi|w{zGZ8@~vJo(c!&9Cf5mHJG2^!`ET8$L7OZ@ zo^tiCPSTjCmmNI}Sai*Cs1he);OEn=Ax=9YzrHs-d{rfyzRMHkAVWopcB|n8{7>bK zaI27l77)^B-lnyl^Ws~m=4qm6XB6jhzzM07qD?g8HU76G?gr=NP6y6*#W6nExlhAq zzQ+4bumd)-LyUMG->~sAmwSmUE{UYnvCO|3;y&B|WNO$L6Oe7k5)L$%tJp*RhJ?e{+&u1d$g#B-VQiRG1-ff{ zoQJWQC1=HTjis$5U7e^;6CKSc-xB}+FA1RoxoQB=bM5DSpQaRl)cUT+bmkl4X4}y* z0N^)9I{%sqT_3WLTcWrXg}0hW6zcwqB!rB%u_d7xcdU!?=*SKFb!S4#{KcsSB~A@W zVe3uyobA#{6J&1~s_$io5Eamz?|^}ry~Yn^8w44#fU~EDEpy5j$Bg35TI7Y2N>L3F z^tsUn2qD4w!V$NT5}|~twuHYlEqkBn$5n?+eoFHJn?)-Uo)n~H-Ux<)a&3nLc2KLV zHkf53{amYSUCI%ahuSYD?c8b|1_B{(gTo!BG<z>Dq;dpEZ!!%)7MGZ6xjt$Hu5&2y?aeTaRIwQcXE%CIZTz=wbay8VTYop^}}{YVHuZ zaE_z5ao0C7MOSzylQjzw6j_i#s{RR*3LZi4!aZkd#IvUt_}^2N@wI8u?MRaxeahW? z+6)qpt|a80uM0U$_r>Ypmu#@D?*~vrg}HCb96n%-LJ4r^NVGPwf(mI#3W7VrBwHUl zTm`hvd@WO!t{1hkUkJQ1_=o&zhgOCJnV6U{6TXL5WBmh=aTDM4HhL z&U{i@!qq9J)D=9t>Y>5aEvJta)k=EH+&SqGdc8_{r&XHQe}A5zG(mjYpZq2Vc4SEU zl2^VY)Y7z|BrXrwujiSmqs2AesNa8Z;$~?ucAI&?NA2kD?E(c@7}9H^>sXvkLi1ph zoo>t1lHlXBSxkAF=Uno)Dl}lTpdtp5Z^ubl6%9@-MZ}r7e-&D(YrqFPL@v3=IA$n% zTVsv_)cr;FJ@^DYv^M$S;jc%Bobw2BMZ^py()e8x{LC6y1z(lZb3F~7G)X`VsU`a+h>3p-+p_B?6yeuBs7Q(PI? z>CN&8elCqa)21HxyW29*{gOO$*>@(z&g@9M>P?gXLiDU~BorR(mJ?dA8hsjRrNDfI z;SljQ_}~`~qukatRaHmA?m#Cs?X_8XkZoF!iNQY19@in;C)5!hbexGt{@w}puspe_ zG3`!`1-5)=)96d|z7bBca;#E4X!AfZ{og4-{AUdjenD!DF2(J?Q05bFt=z{z)+fxE zZhh=-<^t^WoJ>`Q)%;7U+X1%LQO>UhkZH@ZEP4u|>EpUu%h|gA-c8OmSrhTd7v*=d zR5bWS6qul7#5aq!enp7_Er3EW82wZuFQ`sCyXhSKJ#{WBS(>nbVqT}G@MuA*zz|4` zoVPO9i-quvvqeevZtHrBsUvlCSjs9(?Jx-PBaNQuSKYTUl~?jDi2ITmfOMv4n|8P^ zNXdUuG$@m$96>YYKIxd)Rw`ltNX#lWpsl6pVQj9TWP&+Hdw1bUO^>Ixp~NXaG3_ek zv|VwcsypeqcWHR9nGkki$YKc zD9tM&7C8uY$e0F9j$HzJZ~1nY_b(5PyOCru5>0}hQ$gi!h(nU)0PE0|pw|RnvR*L2 zq&w#xFGadf)o$(daziNXt^PD1aJt<3Y$+?c35XTlp0XuZAiHp)~9sYT0X7Q%>jZeLT%n z-~>E;`ZLB`?*DJr*yZ5Bw*+a<+my6(A}-0Sq8eonnLcji;t#oXxbEB&0=M?EYPgYB z5~eHbeOy7VQ~A4h8OW(ZbNp|`aNj;A8^xA~-)Qdu))aZK^nVMvQdP|7Y(Ga~4N+Ap zW?Kh4XOn^3rAlZMuD`BrVxjS5Tos@NQ*+H>*x=F2EsUP29F-bP_qk+Rq&pJO3qLNc z-iwPAa_G-G3yVCkM$$V?8QRn1o;$NnZB<;9f0ZP%!_pLL4zX_7S8*$tDnb3TbK!D6 z>Hi1`i>=tkVkfSI}b;=aFSGG4I53Rv9NrYhL5@3Oa0_o1#$@*~-du`Qn-#8KpA&M|()w1BPvF!Xy@E^F6lnABJi_0F z!TO=k$&fMxkB&i-R;cXO(y9jf)OKXA5SoKWYE9P|M9QKTdV%1AA6KlEWPE03Hw14- zc0pu`^{-Qe{^K+SnIf%&W= zO4Ksd;5dA&0Sp$0&@g4td`DAY(Kbqi4)<$&IHSL~1_=Y!qa%B=($1uJP^!V`@^(6g zaynPrV)J9Y`tSdQU;&EiGl8$`B`E(AHKHKl#gT@tUl-q0>`2cx`KbP1sAOo(1%Yq% z1d>lfg3d^hc}))X&cNh2<(q5nnPvT?3W-1>o3!=KdNid~s9&NH;ILTomRLz{#W=p4 zSrknmU{lb%7_LSlC!wAg{&M~}bi1t$EP6&`I zT-9|!7P9myEr;xLV*_A4a|nNibfsJ*wBPT2X)g9}Ft5>gtp`3hGKt0rl`(p!Q-RAM zUVdY(2By|N>hen6wdM|&S`3OWi8FS(eUcm4*F8ben0xd%Y0=xaRvEXnX>!`55#Gop zm%?ltzNj*iS$@Zlavl?UQ1>R7el;JaGV(2s+=dwA-^gxp{@vq{8HvN84k)L^YQ;_5 z9d4-*qrOSwT-miX#tf#{n;9m@E%$X-&`=H{^6+A%$Tc^HyC-NFner}c5aa6@_3IW* zzF(``F@)lsOkkK#xZ!461Iy-tl;!IP7SsB)>tp53rL+;k=Bx2vpX>5hH*Rm?FRNVp zNy1`W3LG}i3;EP`YMuTTV7l)76L%1j_umG2x~xeB@w`y)Uwaq~VUxQDi6O#ezIeb{ z3%rx#%ov!bQ#dhm8(H_Ah;0XGcCJv@lsTxl(Q)BfWnMkU<$Ci2TsCY*T>!)pJgc{>6y za-FoR;MREdC7VCx%qYkGKkFTjAT%q2K|gaSGKf}VnJ)eU=2{@4I1d@eEvomPUP!a3 ziQ@0k^bcXgbv}K9;J+~pD(iE5(r3vB1tRWxEzH=wZ9f%rN}R@$PNuz@%1JZ1r?!y3 z+4fU7&6hbSrJVe6wTGFFe9q6S`!GyuXm<}h=I zEC5qt)daSF2OqID3L+1XiIngMO;>&wNZgFY!Z)x!S;7@PR_W82$oJhL!P$$PE8Ta% zER$7|;<3&BMqTORE$P_Z+Wi6+5=Wp?7L#u9Cs`lVELap?dFg{{?N+e>Josoza^Jxik+(he$*#T* zL+@p2h0i=UJKF3c2msf_Y5o&al%R8?r?N(ICQ%h`)*yD-SFP#{`p(=|0k2UlGOj^= zK8rgD&algEhgTE8!%DE)j(gVcQo=Qw^o#$o8IsM0$yz`$nuGlv6Si$6)CUlrnj6t? zjWAO*C7we|dk(g@yBL_vXnYrU`h2Z8{+?5pnO*nWnap~3NC{Y^s-97h$x!ao zw7N0=k1az{wyB>*@tG721`r~xq;;7;TA29 zDKbm3KgGP!l;Wm_mUy$|oyAYRi|dM_Qa4MRO>5*tXt@8OCeyAxJnfi-7T~Q}Vo$~$ zoS$Wl!j%fe0_012Qxjm_GB^GjRwU0S3~@oGYKB8W6@(zVKD2o6;kc<@5IjN)nBM-A z(Jb}wSP^Aj!byG41}O)%zBXGJmYE1xWJ()?_of4%{*EJb&}Q9%guURP>EUc~FywN` z*(t-^XXj%Fium%1%`_FM$7#;D>1@0tdI51zsC81zvE<P;%lDE8Dh*qXMP*b)J2*Ukw-Zu%OsoEq3HQ=C&cIOOaj zwhRHVN^COH0r?p6+OVEV6$%(*xO|dmFF|irudc}jc{QbhhzQ#H;&EbSlP4xA?1-_- z^dmpn8ODSO&*ez-0a@g0U%g=2SKWf|X1IGApFzS-d98wPrdw){S;+6AN4VlrMKcILWy_p4JOQX$=4UEpJJy`ZYv zGTS2DWu#ssfWUIr`)Da|697SQwth{bzabS`ud=fop|h+%IOxL=;?Z{(L(@_;Y#jBc zgUh`37K?>hHae*80;xj>=S^?A7S7S2X}a{-!HawWku35-%c|7DbG&|quchl{ZLT>9 zP`^CPRb{XE_;J*?*}qd$O!t43`PVzn@)=?=(v|Ki=^@Ik(bE{{hFTng7Dk>S9mW zI6S|2yR982CgQz=BoexQlL+Rst@F8we^UnWp7}Brq!Ad>h6B^8ymbgtKWZs8yL`qg zZv7-r_6on~AFYb-IQf#lwlHiBcRJ)g>2<6r10R@>hW-%p5a!#vY9i)LiqU~)ek(aL zufMy47LavCZz`yqLmtmJ?0`%)U{%XyUQ}grarMZRKZgyG?DJLkZ&I5*=Hr;IBx~AQm`O1_TD;6FBSURJ+W;glBU|$Yk^D6!`!O`_z~mw zoT!mQ%6E{3u5wIA_ZnodC+@WxTY`Zxy3O-2R_%7=_9|8hSD0NuJGJfX5+-3bg&?y( zLOi|VvHU4T5>A2L;`AM%-%Xgm=8t-T^ng8{w^;OXlNd;0EirGUoM~sr`7DM&_T{eD zaol<)A{ zy);iX@X-4er0)8z&g*ISa#Im$^nml%VRtut8nTSWiZ^Eb-cl*l<+&(-16L`VW|y)V z+e2pvpD&>7|J@Byv+ni$E~m_l2kkJsz@0Zfo&GUob&`g3t)w1}j2-(qb1w1ULyn2U z>qGZkIv=#jKwC^~s5vgVn9)Yjv^RLC+@7bM=Cm;{dv@X~9kDIQHtY{zJ(N=X)YM7; zr7HNi7=>Y;@7#I0m9k$=O0v6OpaEwA-Eio-hIqJ=$|l-!(lB;)``NlPH%~EWj2BW$ z2cU#b|M2#Tf$16|6RVyLkC5-LvHgS0Mg|?=yV_13D7Kn1!@9rPIj|-@|0c;U0L9&zLGer5M!o8H91tt5IR1TTI{_nRz1=1?9=K{GOjwow2gpM zgA;!_h@qB2V@++s$F5QZ+W*@#8{!1pM^hZGsG*XCY490>Fb%9U$Q)Eoc}u)Qm^Nsd zAjU^YrzYo>S#cd#_!ALb?1}k>9S&(aXTj%$7$aT@nuEwo2n1q*lcgkM}Tj2$FM@;3s1@gZ}_dHhqRT!GmRi7wv+MW}mVZn-RH zd-pcsbF->ZGAXm{2M=fljd~krm)gQv1i%UVyp?;pp7JvhPo!oeQ+Nok;=qR=_GL(M zmu|nmg{=K!{nUR62!3tZk83ntXVGlh{aDRR^%Wwh=r?RJFnfX^UF}!J2#yX^?W0Waqueg3Gg^?GHtIIPSZ=Na|j|CWZ01fdHYY zFDzd&Zqw0|Ir1PJamkQSSjJ@icDwbLTz%0|RzGSYo#P&loaGtKx|qj(Poe6w8i#~(wm*e7PYU=s#;a9& zc|1SW-lpOhsoinz0Gd3c{Fp#98lK^c(xi7fV!c1fK`3v1mXSf-u)pOyMY0pCG$Oj2 zilad$^)X#&(7=I9t46jJQniw|LPSw$#54dazu?bvn4oKLD%_X#|D+M~y$#|25<(&pUWd4>xrv@@%nvY0#|gMc{@=2AkFk}wvEB6EbE z?F*HbU3f)|cO`fBMq_14x6pwGk6Gkh?ZZ=FZTl&_&uI6~iEgtIoA4||yEo-0qLUGI zCX1ltcBF)P-w|JIFk+OnRbtHuAAOsqO^13S_LqbQ0JSXC-AVDyt~h&VT4C?3O$+Ya z~ZendTd zeIfS#+MOS~63jA!;TxPvAc2!}Jr=0XL5&ifxelYY?7<1~vi^D!4!mO^bTF;O6vcLS z)st!Gb&tzOzFwceNBA;BcGQi>0b>zjy4u!Zuxh)|+vgLnwdgVFaF5UFb<4jPD5xVsX1xJ792 z4u!#BSVH2IBVgmw)Cm_JOk`mRuqwtoa4n>mb^;=vrDzIEntACaKm#Z5YqCrfRWwthiJDOlmB^0`R2f{>FDL(L0*F|6=Ts}?bT^+&|Et7OVQ6UL)`1~vf|_JayNZQI&>J3*g7TGRBC0U2`Ep98 zDZ2ty6Ao=EVo`I1f5}yHoc?+(UH8Mno>r?Q)+?6p@QL)e({%~g3ylh<4-t|#ubuHc zkFY7J$_g?g2N9Voos6LWDkM9<4_Ndb&GlB*cjjD1yJqP3$K|~wj<3`xTm^5wu{5X) z8Xeat_TP}W0mG@!k5)s;OuoO-z@n3i@gN7%JL<5@f`_`%S@m^^Mfeiz4Vw|exK9*# zZOh=)l+>Z{KNDYW{}d}rFoe=Itd&`Exy}g{*>hrWox>(sM|aB-V{tX=+-#y+iY}t8 zYl*i!%=W80`^jBj8KBPb7isn%mMVv!n*O3C4)^jEqd^}%suVBqHIDK=&*<(4 zOm(%b1rAgHtB1&-SAG1!p3U*UG}5nq0ivqrhL5~KgrZ+w zqTH-8C?Mi7*B$R-UVMIklY0 zuvwJOGGYq5!33m8QGU`*EdG>*92VbeC;Ww_` z5c8@6U&8w~m1WM)cSXG%VW{SuJr_yAeC^%VKT%u(Y6!ci($*1AsTNlCQPrez9*3Ny z$mu!3L>w3Ibhl`@hD^#_0czY-P!lSZ2{}9Fc+LuHOxN|y?{j?K{OKZ}iTxn=OI#!v z+7Yo9PhR~c)u$3G)Y?eW^$()4#8)q}eOQ`DqN!asZaS6RNWfhxy60f{#$uR9W;oEH z&xvMPX+ZjwF{4OY3;BbLdwqorpgzb8F))FExSZLfm6N)gO<-!Seq!BiR+sDwJQg!_w$))-80XOn%R%xu3YseBO;u zOY!61l&+xL584s@+Z3y3E;{M2Q4xV|I_jsg%%L8~?ccxvBzUZ(Zb(r8MXbbtx`q#? z9GCW9-qm23avYtw7gX8K0;lXVi7p_3h+SvM`Sp1Xr4W)}0;##XI>fa5Q3f3CbCKo0 z%h9+QyL+;2n3~8fn=MdngfD9zHP|vgF~*FlW<(5kf^v~!eeH_90M7m+~_GX;_DjzSZ{~tIR5p)i9gMvS*Lu54diAZjY z2&+vSL=#-oXg;RnNzgFVhItrSduy`=JSV3j726a1jxar={}f>n&m zDzX%cb>rOEK%E0y8xG^WaY+5n_LanK;FP!6s7|Rc#=8hr1-2s=#@7UD^O!;0;2;h@ zZno(PPR$XA>u7P0GkIbvvcr#iQhQn0W`Y}jBtC(^z4s~ z8+5{$nOBp%zF^z~EbvkpF!`{aPoaw_$>|sa)><@%NNk`L(rs&rR?lyja->ZDV(^rO zLik*g;?;Xqr0`(=nbWQm;42DYZDrGoD#qfCtRRf(#+k5`6|yLcchnC!bpOzgB+_Ypx)~<^k-3p@vtQ9vh6<dQSqh_Fdl2+}UntkjvJY;jq7zh(>dd8zy5>xM*yqtTC*iKO~6 zc|DGFJq8XjSh)a0f*uFEU_Ut1arKdj%kdHVy?4KuB1*2gK7g0P!;*1=VI+OP?mhPp zdDDJ8x1d-dj9|i>>s>F$h{_ol6-W*8K#w`@69{-DyX!?JvG)wG5yxOQGe5^OAQs(gm{{OB%G?QL3 z@Gg1RK1{`%UknTyITzibCn${!RFGbo%p=d1@gjRJv|4dZ}-q6{6lpZ@+H6ATS{1SC8$;mZRVfRQm(o zPncV-e}OzWNdJ!PtX{61R=&W*WjF@xT-66oj% zTROH=333F$PmkhypN)9T#byC!k;JcCxkEl-jaBH``LG9dpXlGQG!E;)l_pO$k7S`O zsg1sp;)0npJxNHe9&k%M$SZyT9rZMkkv5drlnv2`;uo@iydTu-t=}m0+u*@dr>!(n zO+mY^H&EWJUX8_o){J(u{3bb+^J z7-a>9bBr1r=w3yYW{H!@+8zzLv2z!J+Z5*6gHF9ZFJ(()ETUQhE@MY>(yEoxtpha! zGSD+27ElQ~Mv_-W*~u;}6KP~3INGTGjlyHRfGHMFq3YeudMAsyBYIG3GV=!8DAxOU zs)yrn;gW-FYA)VW8pQQ%WlNRtS}^c+zy6B=)6@^brXZf=U=YUr3ZqWp#DrRcgEAmh%5Eqfvf6D(JaPov z#=>Oq>CVYJCVt7;>q~}i56K#lSfKAl;Gw6QV2fTaYf5MbrXF~(*Za^TkWB%jsP~?h zy;Z5ct^<6vx9q7)X@9G<*vLafSB}O1Y;%Gk3P+&y`g;l;j z#Eu=b=Cqu3Ppsn7@VvpF9^}|Amb_t5^frBV`;>7p02?>ZeT^S$mB*DyeMS{bY&YaG zL!kHoB*u2zPuY4>bb|Pa94m^p>*>2-nAe@|1Hh?hW1vIH>#5_;|0qOj4{ZX0Zg*@n zg?Arjli&*ppJ#g_VSS7Nk*nJn><$XOU9L$`DF7eh-of9{@$;O9j27M1x8b0J*gKKz z{CwC8pY3)IuN>hz=(zf}^&e?__5awllm+txBOt(#6vq)*ovxMf=iJJI^OCG|^!$fF z`ED@}uW6jnrEdeVcc5lUgrPuTvQuII{g5lDw8nO;=PYp(;)E_j7n|+M(7=n*{vIp%%45-$2@$Xrd~j9z96| zGeb5@I?tpmcr}UKgOBY#qS%e+B)rB>3FZAVjv{9|3?mn>&4P|7+t<4D!rwki=E^FC zIo3QC7}19D(7yW$Bi$2`|J3Evlzl|Iky2u1=rIJFBr#wa(m>GF-Gq|N+{uu?@w#Ab zl8_&=lYtTi{(MDJfBvcaR$Jqtl>eacuDTVxUEI#KzVj%H-@CIG3d8hW&~73}1N7%t z`Dewj9*3R7`gMf1n~>$^Um;lAkw!@qf4fA`L&Q2tcPzNMr*jb;lHd!HT`Pbe^`0T$ z=i!|p$@7~iGyyrhcz!^V3uTcn<0=`SF&O2aMmzAx;Gwy&!f@U;j*PItcO-mdIq+zo z%zrx(lcppwQO&-6Y;Ot}(qTOc7}`)GIa7XoYPYZe+32qq3U{dyVUg_NAtFa`%y`ZT zLpd+CIeJWv$MLc`lEJ5VrK|Jb2Gv_ERrir7}d| z67uk#3nG=}1o-E>U4a6q4@sj_iceUEk`8QMJa6qeUH$SHyHnB<2dPx&^~%nOD0RY5c}oD zDrb5zhem+lv0o-yt+(v=OZ>}<3m$qbvjQY}g&_&q_D`ndjH64*z?&sY>ZV42!ty*` XAOB2z4mh_BB?v|?L2DPyvG8)asKJ(8 diff --git a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml new file mode 100644 index 000000000..9681f1e26 --- /dev/null +++ b/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +clusters: +- cluster: + certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + server: https://172.31.66.49:6443 + name: esgotest +contexts: +- context: + cluster: esgotest + user: esgotest + name: esgotest +current-context: esgotest +kind: Config +preferences: {} +users: +- name: esgotest + user: + client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml b/terraform/modules/aws/rke2-cluster/ansible/inventory.yml new file mode 100755 index 000000000..ac5c4f340 --- /dev/null +++ b/terraform/modules/aws/rke2-cluster/ansible/inventory.yml @@ -0,0 +1,49 @@ +--- +all: + vars: + cluster_name: "esgotest" + cluster_env_domain: "mosip.local" + k8s_infra_repo_url: "https://github.com/mosip/k8s-infra.git" + k8s_infra_branch: "release-1.2.1.x" + install_rke2_version: "v1.28.9+rke2r1" + enable_rancher_import: true + rancher_import_url: "kubectl apply -f https://rancher.mosip.net/v3/import/f25prw8zrsc959n2bk25mn79twtwmpq6hpxphf9xt97dhbm797r99n_c-stb2m.yaml" + ansible_user: ubuntu + ansible_ssh_private_key_file: ./ssh_key + ansible_ssh_common_args: '-o StrictHostKeyChecking=no' + + children: + control_plane: + hosts: + esgotest-CONTROL-PLANE-NODE-1: + ansible_host: 172.31.66.49 + node_role: control_plane + is_primary: true + node_index: 0 + + etcd: + hosts: + esgotest-ETCD-NODE-1: + ansible_host: 172.31.69.175 + node_role: etcd + + workers: + hosts: + esgotest-WORKER-NODE-1: + ansible_host: 172.31.77.192 + node_role: worker + esgotest-WORKER-NODE-2: + ansible_host: 172.31.74.226 + node_role: worker + esgotest-WORKER-NODE-3: + ansible_host: 172.31.79.164 + node_role: worker + esgotest-WORKER-NODE-4: + ansible_host: 172.31.76.206 + node_role: worker + + rke2_cluster: + children: + control_plane: + etcd: + workers: From 2263db9c3e33955cf1b404b6b10b30f2919a9a41 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Thu, 23 Jul 2026 19:38:49 +0530 Subject: [PATCH 009/127] Update external-dsf.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- Helmsman/dsf/esignet-standalone/external-dsf.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index 5e0bdf77d..43066283f 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -252,7 +252,7 @@ apps: # Initializes mosip_audit, mosip_kernel, mosip_otp (v1.2.0.1 branch). postgres-init-signup: namespace: signup - enabled: true + enabled: false version: 12.0.1 chart: mosip/postgres-init set: @@ -539,4 +539,4 @@ apps: timeout: 1200 hooks: postInstall: "$WORKDIR/hooks/s3-setup.sh" - priority: -2 \ No newline at end of file + priority: -2 From e9aeffb38ed1b4dd2016594e78e9ef425bf42282 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 23 Jul 2026 20:22:54 +0530 Subject: [PATCH 010/127] fix: #302 Add missing su.secret fields to mosip_esignet/mosip_mockidentitysystem database entries (postgres-init-esignet chart 0.0.1-develop requires them unconditionally), and disable postgres-init-signup by default per its own comment. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone/external-dsf.yaml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index 5e0bdf77d..10c14d683 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -109,6 +109,11 @@ apps: databases.mosip_esignet.host: "postgres.${domain_name}" databases.mosip_esignet.port: ${esignet_db_port} databases.mosip_esignet.dml: 1 + databases.mosip_esignet.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet.defaultDb: "postgres" + databases.mosip_esignet.su.user: "postgres" + databases.mosip_esignet.su.secret.name: "postgres-postgresql" + databases.mosip_esignet.su.secret.key: "postgres-password" databases.mosip_esignet_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" databases.mosip_esignet_mosipid1.defaultDb: "postgres" databases.mosip_esignet_mosipid1.su.user: "postgres" @@ -174,6 +179,10 @@ apps: databases.mosip_mockidentitysystem.repoUrl: "https://github.com/mosip/esignet-mock-services.git" databases.mosip_mockidentitysystem.port: ${esignet_db_port} databases.mosip_mockidentitysystem.dml: 1 + databases.mosip_mockidentitysystem.defaultDb: "postgres" + databases.mosip_mockidentitysystem.su.user: "postgres" + databases.mosip_mockidentitysystem.su.secret.name: "postgres-postgresql" + databases.mosip_mockidentitysystem.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- # esignet-standalone-2.0.0 profile — isolated databases (own data, shared postgres) # --------------------------------------------------------------------------- @@ -238,6 +247,10 @@ apps: databases.mosip_mockidentitysystem_2_0_0.repoUrl: "https://github.com/mosip/esignet-mock-services.git" databases.mosip_mockidentitysystem_2_0_0.port: ${esignet_db_port} databases.mosip_mockidentitysystem_2_0_0.dml: 1 + databases.mosip_mockidentitysystem_2_0_0.defaultDb: "postgres" + databases.mosip_mockidentitysystem_2_0_0.su.user: "postgres" + databases.mosip_mockidentitysystem_2_0_0.su.secret.name: "postgres-postgresql" + databases.mosip_mockidentitysystem_2_0_0.su.secret.key: "postgres-password" wait: true timeout: 300 priority: -16 @@ -252,7 +265,7 @@ apps: # Initializes mosip_audit, mosip_kernel, mosip_otp (v1.2.0.1 branch). postgres-init-signup: namespace: signup - enabled: true + enabled: false version: 12.0.1 chart: mosip/postgres-init set: From 56605449a39f6e5a86829f26a403380c77fb6724 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 23 Jul 2026 20:52:55 +0530 Subject: [PATCH 011/127] fix: #302 Copy keycloak-host/keycloak-env-vars/keycloak/keycloak-client-secrets into the esignet-standalone-2.0.0 namespace, since the shared external-dsf.yaml fan-out hook only targets the original esignet-standalone namespaces. Onboarder apps in this namespace reference these directly. Signed-off-by: bhumi46 --- .../esignet-preinstall.sh | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index 34758454e..804e012eb 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -17,6 +17,7 @@ set -euo pipefail ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" POSTGRES_NS="postgres" REDIS_NS="redis" +KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" @@ -59,4 +60,24 @@ $COPY_UTIL secret redis "$REDIS_NS" "$ESIGNET_NS" echo "Copying db-common-secrets secret from $POSTGRES_NS" $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" +# keycloak-host/keycloak-env-vars/keycloak/keycloak-client-secrets are normally fanned +# out by esignet-postinstall-keycloak-init.sh (postInstall hook of the shared +# external-dsf.yaml esignet-keycloak-init release), but that hook's namespace loop only +# covers the original esignet-standalone namespaces. Copy them directly here so the +# 2.0.0 namespace is self-sufficient without touching the shared hook. This runs for +# every instance that delegates to this script (esignet-mock-2-0-0 plus the +# mosipid1/mosipid2/sunbird wrappers), matching the original profile's fan-out to all +# four namespaces. +echo "Copying keycloak-host configmap from $KEYCLOAK_NS" +$COPY_UTIL configmap keycloak-host "$KEYCLOAK_NS" "$ESIGNET_NS" + +echo "Copying keycloak-env-vars configmap from $KEYCLOAK_NS" +$COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$ESIGNET_NS" + +echo "Copying keycloak secret from $KEYCLOAK_NS" +$COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" + +echo "Copying keycloak-client-secrets secret from $KEYCLOAK_NS" +$COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" + echo "eSignet pre-install completed." From b32c47e67bc052cc1f1023e0d0e8f38ccbbf31b2 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 24 Jul 2026 00:06:59 +0530 Subject: [PATCH 012/127] fix: #302 Fix chart-auto-generated *-share configmap name mismatches (release-name-derived, not part of the original rename token vocabulary), and duplicate the 6 shared utils values files that hardcoded old secret names (esignet-captcha, esignet-softhsm*, softhsm-mock-identity-system) into a new Helmsman/utils/esignet-standalone-2.0.0/ directory, repointing esignet-dsf.yaml at the isolated copies. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 30 ++-- .../config-server-esignet-postinstall.sh | 2 +- .../mock-identity-system-preinstall.sh | 6 +- ...ofthsm-mock-identity-system-postinstall.sh | 6 +- .../config-server-esignet-values-2-0-0.yaml | 139 +++++++++++++++++ .../esignet-mosipid1-plugin-values-2-0-0.yaml | 119 ++++++++++++++ .../esignet-mosipid2-plugin-values-2-0-0.yaml | 118 ++++++++++++++ .../esignet-plugin-values-2-0-0.yaml | 147 ++++++++++++++++++ .../esignet-sunbird-plugin-values-2-0-0.yaml | 85 ++++++++++ .../mock-identity-values-2-0-0.yaml | 50 ++++++ 10 files changed, 680 insertions(+), 22 deletions(-) create mode 100644 Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml create mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml create mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml create mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml create mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml create mode 100755 Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 06317ebde..d005e5240 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -94,7 +94,7 @@ apps: enabled: false version: 12.0.1 chart: mosip/config-server - valuesFile: "$WORKDIR/utils/config-server-esignet-values.yaml" + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml" wait: true timeout: 1200 priority: -15 @@ -110,7 +110,7 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-plugin-values.yaml" + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet-with-plugins" image.tag: "develop" @@ -119,7 +119,7 @@ apps: activeProfileEnv: "" pluginNameEnv: "esignet-mock-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-share" + extraEnvVarsCM[0]: "esignet-softhsm-2-0-0-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" domainConfig.MOSIP_ESIGNET_HOST: "esignet-2-0-0.${domain_name}" @@ -142,7 +142,7 @@ apps: enabled: true version: 0.1.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-mosipid1-plugin-values.yaml" + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet-with-plugins" image.tag: "develop" @@ -151,7 +151,7 @@ apps: activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid1-share" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid1-2-0-0-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid1-2-0-0.${domain_name}" @@ -182,7 +182,7 @@ apps: enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-mosipid2-plugin-values.yaml" + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet-with-plugins" image.tag: "develop" @@ -191,7 +191,7 @@ apps: activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid2-share" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid2-2-0-0-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid2-2-0-0.${domain_name}" @@ -222,7 +222,7 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-sunbird-plugin-values.yaml" + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet-with-plugins" image.tag: "develop" @@ -231,7 +231,7 @@ apps: activeProfileEnv: "" pluginNameEnv: "sunbird-rc-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-sunbird-share" + extraEnvVarsCM[0]: "esignet-softhsm-sunbird-2-0-0-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" domainConfig.MOSIP_ESIGNET_HOST: "esignet-sunbird-2-0-0.${domain_name}" @@ -346,12 +346,12 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-identity-system - valuesFile: "$WORKDIR/utils/mock-identity-values.yaml" + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml" set: image.repository: "mosipqa/mock-identity-system" image.tag: "develop" enable_insecure: "false" - extraEnvVarsCM[0]: "softhsm-mock-identity-system-share" + extraEnvVarsCM[0]: "softhsm-mock-identity-system-2-0-0-share" domainConfig.MOSIP_ESIGNET_HOST: "esignet-2-0-0.${domain_name}" domainConfig.MOSIP_SIGNUP_HOST: "signup-2-0-0.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" @@ -522,7 +522,7 @@ apps: istio.gateways[0]: "pms-partner-mosipid1-gateway" istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1-2-0-0.${domain_name}" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" + extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" priority: -9 timeout: 1200 hooks: @@ -539,7 +539,7 @@ apps: istio.gateways[0]: "pms-partner-mosipid1-gateway" istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1-2-0-0.${domain_name}" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" + extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" priority: -9 timeout: 1200 @@ -554,7 +554,7 @@ apps: istio.gateways[0]: "pms-partner-mosipid2-gateway" istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2-2-0-0.${domain_name}" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" + extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" priority: -9 timeout: 1200 hooks: @@ -570,7 +570,7 @@ apps: # image.tag: "1.2.2.2" istio.gateways[0]: "pms-partner-mosipid2-gateway" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" + extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2-2-0-0.${domain_name}" priority: -9 timeout: 1200 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh index 44e1dd728..974350f08 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh @@ -14,7 +14,7 @@ set -euo pipefail SOURCE_NS="esignet-mock-2-0-0" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CM_NAME="esignet-config-server-share" +CM_NAME="esignet-config-server-2-0-0-share" MOSIPID1_SPRING_LABEL="${ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL:-develop}" MOSIPID2_SPRING_LABEL="${ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL:-develop}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh index 8dec26b46..14ee1ed42 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -5,7 +5,7 @@ # Prepares esignet namespace for mock identity system deployment: # - Copies softhsm-mock-identity-system secret from softhsm ns # - Creates mockid-postgres-config with mock identity DB values -# - Verifies softhsm-mock-identity-system-share ConfigMap is present +# - Verifies softhsm-mock-identity-system-2-0-0-share ConfigMap is present # # Environment Variables: # MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem) @@ -50,10 +50,10 @@ kubectl -n "$ESIGNET_NS" create configmap mockid-postgres-config \ echo "mockid-postgres-config created/updated in $ESIGNET_NS (host=$DB_HOST db=$MOCKID_DB_NAME user=$MOCKID_DB_USER)." # Verify SoftHSM mock identity configmap exists in esignet namespace -if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-share &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-2-0-0-share &>/dev/null; then echo "SoftHSM mock identity system configmap found." else - echo "ERROR: softhsm-mock-identity-system-share configmap not found in $ESIGNET_NS namespace." + echo "ERROR: softhsm-mock-identity-system-2-0-0-share configmap not found in $ESIGNET_NS namespace." echo "Deploy softhsm-mock-identity-system-2-0-0 before running mock identity system install." exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh index 192ef4dfd..328b44d70 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh @@ -2,7 +2,7 @@ # ============================================================================= # eSignet 1.7.1 - SoftHSM Mock Identity System Post-install # ============================================================================= -# Copies chart-generated softhsm-mock-identity-system-share configmap +# Copies chart-generated softhsm-mock-identity-system-2-0-0-share configmap # (PKCS11 slot/token config) from softhsm namespace to esignet-mock namespace. # The security PIN is handled separately via secret copy in preinstall. # ============================================================================= @@ -21,7 +21,7 @@ kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/ins { echo "ERROR: SoftHSM mock identity system pod not ready after timeout" >&2; exit 1; } # Copy chart-generated PKCS11 configmap to esignet-mock namespace -echo "Copying softhsm-mock-identity-system-share configmap to $ESIGNET_NS" -$COPY_UTIL configmap softhsm-mock-identity-system-share "$SOFTHSM_NS" "$ESIGNET_NS" +echo "Copying softhsm-mock-identity-system-2-0-0-share configmap to $ESIGNET_NS" +$COPY_UTIL configmap softhsm-mock-identity-system-2-0-0-share "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM mock identity system post-install completed." diff --git a/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml new file mode 100644 index 000000000..5f1faa2fb --- /dev/null +++ b/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml @@ -0,0 +1,139 @@ +# Config-server values for eSignet standalone profile. +# Based on: esignet/deploy/config-server/values.yaml +# +# Domain values (API_HOST, ESIGNET_HOST, etc.) are read from the +# esignet-global ConfigMap created by config-server-esignet-setup.sh +# from workflow env vars — no static domain values here. +# +# envVariables is a Helm list — this file is the single source of truth for +# all entries. Do NOT partially override via a second -f file; it replaces +# the whole list. + +gitRepo: + uri: https://github.com/mosip/mosip-config + version: esqa-2 + searchFolders: "" + private: false + username: "" + token: "" + +resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + limits: + cpu: 400m + memory: 2000Mi + requests: + cpu: 200m + memory: 1500Mi + +envVariables: + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_DB_DBUSER_PASSWORD + valueFrom: + secretKeyRef: + name: db-common-secrets + key: db-dbuser-password + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_API_PUBLIC_HOST + valueFrom: + configMapKeyRef: + name: esignet-global + key: mosip-api-host + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_API_INTERNAL_HOST + valueFrom: + configMapKeyRef: + name: esignet-global + key: mosip-api-internal-host + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_INTERNAL_URL + valueFrom: + configMapKeyRef: + name: keycloak-host + key: keycloak-internal-url + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_EXTERNAL_URL + valueFrom: + configMapKeyRef: + name: keycloak-host + key: keycloak-external-url + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_ESIGNET_HOST + valueFrom: + configMapKeyRef: + name: esignet-global + key: mosip-esignet-host + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_INTERNAL_HOST + valueFrom: + configMapKeyRef: + name: keycloak-host + key: keycloak-internal-host + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_EXTERNAL_HOST + valueFrom: + configMapKeyRef: + name: keycloak-host + key: keycloak-external-host + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MPARTNER_DEFAULT_AUTH_SECRET + valueFrom: + secretKeyRef: + name: keycloak-client-secrets + key: mpartner_default_auth_secret + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_SOFTHSM_ESIGNET_SECURITY_PIN + valueFrom: + secretKeyRef: + name: esignet-softhsm-2-0-0 + key: security-pin + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ESIGNET_CAPTCHA_SECRET_KEY + valueFrom: + secretKeyRef: + name: esignet-captcha-2-0-0 + key: esignet-captcha-secret-key + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ESIGNET_CAPTCHA_SITE_KEY + valueFrom: + secretKeyRef: + name: esignet-captcha-2-0-0 + key: esignet-captcha-site-key + enabled: true + + # Placeholder until MISP onboarder runs (priority -6). + # After onboarder writes the real key, config-server is restarted by + # esignet-misp-onboarder-postinstall.sh so the updated secret is loaded. + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_ESIGNET_MISP_KEY + valueFrom: + secretKeyRef: + name: esignet-misp-onboarder-key + key: mosip-esignet-misp-key + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_PMS_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: keycloak-client-secrets + key: mosip_pms_client_secret + enabled: true + + - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_SIGNUP_HOST + valueFrom: + configMapKeyRef: + name: esignet-global + key: mosip-signup-host + enabled: true diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml new file mode 100644 index 000000000..22491ea1d --- /dev/null +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -0,0 +1,119 @@ +# eSignet MOSIPID1 — plugin 2 (mosip-identity-plugin) runtime configuration. +# pluginNameEnv=mosip-identity-plugin.jar set in DSF set: block. +# Update IDA service URLs below to match your MOSIP IDA deployment. + +# Override full extraEnvVars to use namespace-specific softhsm secret name. +extraEnvVars: + - name: KEYCLOAK_EXTERNAL_URL + valueFrom: + configMapKeyRef: + name: keycloak-host + key: keycloak-external-url + - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME + value: esignet + - name: REDIS_HOST + valueFrom: + configMapKeyRef: + name: redis-config + key: redis-host + - name: REDIS_PORT + valueFrom: + configMapKeyRef: + name: redis-config + key: redis-port + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis + key: redis-password + - name: DATABASE_HOST + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-host + - name: DATABASE_PORT + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-port + - name: DATABASE_NAME + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-name + - name: DATABASE_USERNAME + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-username + - name: DB_DBUSER_PASSWORD + valueFrom: + secretKeyRef: + name: db-common-secrets + key: db-dbuser-password + - name: SOFTHSM_ESIGNET_SECURITY_PIN + valueFrom: + secretKeyRef: + name: esignet-softhsm-mosipid1-2-0-0 + key: security-pin + - name: MOSIP_IDA_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: keycloak-client-secrets-mosipid1 + key: mosip_ida_client_secret + +extraEnvVarsAdditional: + - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" + value: "esignetmosipid1" + - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" + valueFrom: + secretKeyRef: + name: esignet-captcha-mosipid1-2-0-0 + key: esignet-captcha-site-key + + # --------------------------------------------------------------------------- + # Plugin 2: mosip-identity-plugin + # Update URLs to match your MOSIP IDA deployment. + # --------------------------------------------------------------------------- + - name: NAMESPACE + value: mosipid1 + - name: plugin_name_env + value: mosip-identity-plugin.jar + - name: SPRING_KAFKA_CONSUMER_GROUP_ID + value: esignet-consumer-esignet-mosipid1 + - name: MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE + value: esignet-mosipid1-signup-esqa020 + - name: MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS + value: email,phone + - name: MOSIP_ESIGNET_SEND_OTP_ATTEMPTS + value: '300' + - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS + value: '300' + - name: MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS + value: '600' + - name: MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS + value: '600' + - name: MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX + value: '@phone' + - name: MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS + value: >- + {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': + 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': + 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', + 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': + 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': + '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': + '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': + 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': + '@email', 'maxLength': '', 'regex': '' {{ "}}" }} + - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT + value: DEBUG + - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED + value: "false" + - name: MOSIP_ESIGNET_CAPTCHA_URL + value: http://captcha.captcha + - name: "MOSIP_ESIGNET_MISP_KEY" + valueFrom: + secretKeyRef: + name: esignet-misp-onboarder-key + key: mosip-esignet-misp-key diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml new file mode 100644 index 000000000..de7a6de77 --- /dev/null +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -0,0 +1,118 @@ +# eSignet MOSIPID2 — plugin 2 (mosip-identity-plugin) runtime configuration. +# pluginNameEnv=mosip-identity-plugin.jar set in DSF set: block. +# Update IDA service URLs below to match your MOSIP IDA deployment. + +# Override full extraEnvVars to use namespace-specific softhsm secret name. +extraEnvVars: + - name: KEYCLOAK_EXTERNAL_URL + valueFrom: + configMapKeyRef: + name: keycloak-host + key: keycloak-external-url + - name: REDIS_HOST + valueFrom: + configMapKeyRef: + name: redis-config + key: redis-host + - name: REDIS_PORT + valueFrom: + configMapKeyRef: + name: redis-config + key: redis-port + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis + key: redis-password + - name: DATABASE_HOST + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-host + - name: DATABASE_PORT + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-port + - name: DATABASE_NAME + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-name + - name: DATABASE_USERNAME + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-username + - name: DB_DBUSER_PASSWORD + valueFrom: + secretKeyRef: + name: db-common-secrets + key: db-dbuser-password + - name: SOFTHSM_ESIGNET_SECURITY_PIN + valueFrom: + secretKeyRef: + name: esignet-softhsm-mosipid2-2-0-0 + key: security-pin + - name: MOSIP_IDA_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: keycloak-client-secrets-mosipid2 + key: mosip_ida_client_secret + +extraEnvVarsAdditional: + - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" + value: "esignetmosipid2" + - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" + valueFrom: + secretKeyRef: + name: esignet-captcha-mosipid2-2-0-0 + key: esignet-captcha-site-key + + # --------------------------------------------------------------------------- + # Plugin 2: mosip-identity-plugin + # Update URLs to match your MOSIP IDA deployment. + # --------------------------------------------------------------------------- + - name: NAMESPACE + value: mosipid2 + - name: plugin_name_env + value: mosip-identity-plugin.jar + - name: SPRING_KAFKA_CONSUMER_GROUP_ID + value: esignet-consumer-esignet-mosipid2 + - name: MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE + value: esignet-mosipid2-signup-esqa020 + - name: MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS + value: email,phone + - name: MOSIP_ESIGNET_SEND_OTP_ATTEMPTS + value: '300' + - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS + value: '300' + - name: MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS + value: '600' + - name: MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS + value: '600' + - name: MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX + value: '@phone' + - name: MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS + value: >- + {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': + 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': + 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', + 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': + 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': + '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': + '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': + 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': + '@email', 'maxLength': '', 'regex': '' {{ "}}" }} + - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT + value: DEBUG + - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED + value: "" + - name: MOSIP_ESIGNET_CAPTCHA_URL + value: http://captcha.captcha + - name: "MOSIP_ESIGNET_MISP_KEY" + valueFrom: + secretKeyRef: + name: esignet-misp-onboarder-key + key: mosip-esignet-misp-key + diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml new file mode 100644 index 000000000..a3f4785b9 --- /dev/null +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -0,0 +1,147 @@ +# eSignet standalone — plugin and captcha runtime configuration. +# +# Plugin selection: +# Plugin 1 (mock): pluginNameEnv=esignet-mock-plugin.jar → no changes needed here +# Plugin 2 (mosip-identity): pluginNameEnv=mosip-identity-plugin.jar → uncomment IDA section below +# Plugin 3 (sunbird-rc): pluginNameEnv=sunbird-rc-plugin.jar → uncomment Sunbird section below +# Plugin 4 (custom): pluginNameEnv= pluginUrlEnv= → no changes needed here +# + +## Uncomment required parms added with single '#' when needed. + + +extraEnvVars: + - name: KEYCLOAK_EXTERNAL_URL + valueFrom: + configMapKeyRef: + name: keycloak-host + key: keycloak-external-url + - name: MOSIP_ESIGNET_CAPTCHA_SITE_KEY + valueFrom: + secretKeyRef: + name: esignet-captcha-2-0-0 + key: esignet-captcha-site-key + - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME + value: esignet + - name: REDIS_HOST + valueFrom: + configMapKeyRef: + name: redis-config + key: redis-host + - name: REDIS_PORT + valueFrom: + configMapKeyRef: + name: redis-config + key: redis-port + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis + key: redis-password + - name: DATABASE_HOST + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-host + - name: DATABASE_PORT + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-port + - name: DATABASE_NAME + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-name + - name: DATABASE_USERNAME + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-username + - name: DB_DBUSER_PASSWORD + valueFrom: + secretKeyRef: + name: db-common-secrets + key: db-dbuser-password + - name: SOFTHSM_ESIGNET_SECURITY_PIN + valueFrom: + secretKeyRef: + name: esignet-softhsm-2-0-0 + key: security-pin + - name: MOSIP_IDA_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: keycloak-client-secrets + key: mosip_ida_client_secret + +# extraEnvVarsCM: +# - esignet-softhsm-share + +#extraEnvVarsSecret: [] + +#istio: +# enabled: true +# gateways: +# - istio-system/public +# - istio-system/internal +# prefix: /v1/esignet/ + + + +# extraEnvVarsAdditional is a Helm list — this file REPLACES the base list on merge. +# All required entries (captcha + plugin-specific) must be present together. + +extraEnvVarsAdditional: + # Captcha site key — from esignet-captcha secret (deployed by external-dsf) + - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" + valueFrom: + secretKeyRef: + name: esignet-captcha-2-0-0 + key: esignet-captcha-site-key + - name: "MOSIP_ESIGNET_CAPTCHA_REQUIRED" + value: "" + + # --------------------------------------------------------------------------- + # Plugin 2: mosip-identity-plugin + # Uncomment all entries below when pluginNameEnv=mosip-identity-plugin.jar. + # Update URLs to match your MOSIP IDA deployment if the defaults don't apply. + # --------------------------------------------------------------------------- + # + # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL" + # value: "http://mosip-file-server.mosip-file-server/mosip-certs/ida-partner.cer" + # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-AUTH-URL" + # value: "http://ida-auth.ida/idauthentication/v1/kyc-auth/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" + # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-EXCHANGE-URL" + # value: "http://ida-auth.ida/idauthentication/v1/kyc-exchange/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" + # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_SEND-OTP-URL" + # value: "http://ida-otp.ida/idauthentication/v1/otp/${mosip.esignet.authenticator.ida.misp-license-key}/" + # - name: "MOSIP_ESIGNET_BINDER_IDA_KEY-BINDING-URL" + # value: "http://ida-auth.ida/idauthentication/v1/identity-key-binding/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" + # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_GET-CERTIFICATES-URL" + # value: "http://ida-internal.ida/idauthentication/v1/internal/getAllCertificates" + # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH-TOKEN-URL" + # value: "http://authmanager.kernel/v1/authmanager/authenticate/clientidsecretkey" + # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT-MANAGER-URL" + # value: "http://auditmanager.kernel/v1/auditmanager/audits" + # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP-CHANNELS" + # value: "email,phone" + # - name: "MOSIP_ESIGNET_MISP_KEY" + # valueFrom: + # secretKeyRef: + # name: esignet-misp-onboarder-key + # key: mosip-esignet-misp-key + + # --------------------------------------------------------------------------- + # Plugin 3: sunbird-rc-plugin + # Uncomment all entries below when pluginNameEnv=sunbird-rc-plugin.jar. + # Set MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL to your Sunbird registry host. + # --------------------------------------------------------------------------- + # + # - name: "MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL" + # value: "https://your-sunbird-registry-host" + # - name: "MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL" + # value: "https://your-sunbird-registry-host/api/v1/Insurance/search" + # - name: "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN" + # value: "LoggerAuditService" + # - name: "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER" + # value: "NoOpKeyBinder" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml new file mode 100644 index 000000000..811b508d6 --- /dev/null +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -0,0 +1,85 @@ +# eSignet Sunbird — plugin 3 (sunbird-rc-plugin) runtime configuration. +# pluginNameEnv=sunbird-rc-plugin.jar set in DSF set: block. +# Update MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL to your Sunbird registry host. + +# Override full extraEnvVars to use namespace-specific softhsm secret name. +extraEnvVars: + - name: KEYCLOAK_EXTERNAL_URL + valueFrom: + configMapKeyRef: + name: keycloak-host + key: keycloak-external-url + - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME + value: esignet + - name: REDIS_HOST + valueFrom: + configMapKeyRef: + name: redis-config + key: redis-host + - name: REDIS_PORT + valueFrom: + configMapKeyRef: + name: redis-config + key: redis-port + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis + key: redis-password + - name: DATABASE_HOST + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-host + - name: DATABASE_PORT + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-port + - name: DATABASE_NAME + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-name + - name: DATABASE_USERNAME + valueFrom: + configMapKeyRef: + name: postgres-config + key: database-username + - name: DB_DBUSER_PASSWORD + valueFrom: + secretKeyRef: + name: db-common-secrets + key: db-dbuser-password + - name: SOFTHSM_ESIGNET_SECURITY_PIN + valueFrom: + secretKeyRef: + name: esignet-softhsm-sunbird-2-0-0 + key: security-pin + - name: MOSIP_IDA_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: keycloak-client-secrets + key: mosip_ida_client_secret + +extraEnvVarsAdditional: + - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" + valueFrom: + secretKeyRef: + name: esignet-captcha-sunbird-2-0-0 + key: esignet-captcha-site-key + - name: "MOSIP_ESIGNET_CAPTCHA_REQUIRED" + value: "" + + # --------------------------------------------------------------------------- + # Plugin 3: sunbird-rc-plugin + # Update URLs to match your Sunbird RC registry deployment. + # --------------------------------------------------------------------------- + - name: "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN" + value: "LoggerAuditService" + - name: "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER" + value: "NoOpKeyBinder" + - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS + value: '300' + - name: MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD + value: "policyNumber" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml new file mode 100755 index 000000000..e6fc7ff13 --- /dev/null +++ b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml @@ -0,0 +1,50 @@ +extraEnvVars: + - name: DATABASE_HOST + valueFrom: + configMapKeyRef: + name: mockid-postgres-config + key: database-host + - name: DATABASE_PORT + valueFrom: + configMapKeyRef: + name: mockid-postgres-config + key: database-port + - name: DATABASE_NAME + valueFrom: + configMapKeyRef: + name: mockid-postgres-config + key: database-name + - name: DATABASE_USERNAME + valueFrom: + configMapKeyRef: + name: mockid-postgres-config + key: database-username + - name: DB_DBUSER_PASSWORD + valueFrom: + secretKeyRef: + name: db-common-secrets + key: db-dbuser-password + - name: SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN + valueFrom: + secretKeyRef: + name: softhsm-mock-identity-system-2-0-0 + key: security-pin + - name: hsm_local_dir_name + value: hsm-client + - name: MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS + value: individualId,password + - name: REDIS_HOST + valueFrom: + configMapKeyRef: + name: redis-config + key: redis-host + - name: REDIS_PORT + valueFrom: + configMapKeyRef: + name: redis-config + key: redis-port + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redis + key: redis-password From f31aea357b0eb08a42600872d6f43fe7a886c3f2 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 24 Jul 2026 00:26:30 +0530 Subject: [PATCH 013/127] fix: #302 Revert mock-smtp public hostname back to shared smtp.${domain_name} for esignet-standalone-2.0.0, since smtp-2-0-0 was intentionally not added to the terraform DNS subdomain list. Internal cluster-DNS references (mock-smtp-2-0-0.mock-smtp-2-0-0) are unaffected, as they resolve via CoreDNS regardless of any Route53 record. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 +++++----- Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml | 2 +- .../config-server-esignet-setup.sh | 2 +- .../esignet-mosipid1-preinstall.sh | 2 +- .../esignet-mosipid2-preinstall.sh | 2 +- .../esignet-sunbird-preinstall.sh | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index d005e5240..38d63748b 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -129,7 +129,7 @@ apps: domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp-2-0-0.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" timeout: 600 priority: -14 @@ -161,7 +161,7 @@ apps: domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp-2-0-0.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid1_domain_name}" domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid1_domain_name}" @@ -201,7 +201,7 @@ apps: domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp-2-0-0.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid2_domain_name}" domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid2_domain_name}" @@ -241,7 +241,7 @@ apps: domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp-2-0-0.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" @@ -359,7 +359,7 @@ apps: domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp-2-0-0.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" domainConfig.MOSIP_MOCK_IDA_IDENTITY_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/email-signup-schema-testing.json" domainConfig.MOSIP_MOCK_UI_SPEC_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/ui_spec_reset_password_phone.json" diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml index 8ca5b652d..3bcfb9196 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml @@ -134,7 +134,7 @@ apps: version: 1.0.0 chart: mosip/mock-smtp set: - istio.hosts[0]: "smtp-2-0-0.${domain_name}" + istio.hosts[0]: "smtp.${domain_name}" wait: true timeout: 300 priority: -5 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh index 4f7e92cd9..47bf68be8 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh @@ -59,7 +59,7 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ --from-literal=mosip-signup-host="signup-2-0-0.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp-2-0-0.${domain_name}" \ + --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - echo "esignet-global created/updated." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh index 2d4a6e224..80cb4359a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh @@ -29,7 +29,7 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ --from-literal=mosip-signup-host="signup-mosipid1-2-0-0.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp-2-0-0.${domain_name}" \ + --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh index b30ac5643..5ce7ae6c5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh @@ -29,7 +29,7 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ --from-literal=mosip-signup-host="signup-mosipid2-2-0-0.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp-2-0-0.${domain_name}" \ + --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh index 6e0da08dc..548d950c4 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh @@ -27,7 +27,7 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ --from-literal=mosip-signup-host="signup-sunbird-2-0-0.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp-2-0-0.${domain_name}" \ + --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - From 7b26619e465ffdeea9274573ee461119b397b548 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 24 Jul 2026 13:06:00 +0530 Subject: [PATCH 014/127] fix: #302 Rename esignet-mock/mosipid1/mosipid2/sunbird namespaces, Helm release names, and hostnames to esignet-go-* within the esignet-standalone-2.0.0 profile only, dropping the -2-0-0 suffix on every identifier touched. Also renames the base SoftHSM release and captcha secrets/env-vars (esignet-softhsm-2-0-0 -> esignet-softhsm-go, esignet-captcha-2-0-0 -> esignet-captcha-go, softhsm-mock-identity-system-2-0-0 -> softhsm-mock-identity-system-go, plus mosipid1/mosipid2/sunbird equivalents) for consistency with the new naming scheme, and fixes a latent bug where captcha-postinstall.sh created the base captcha secret with suffixed key names that didn't match what the values files expected. Restructures helmsman_esignet.yml's softhsm-upgrade-skip release:namespace pairs from a single suffix variable into an explicit per-profile list, since the 2.0.0 profile's release and namespace names no longer share one common suffix pattern. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 14 +- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 244 +++++++++--------- .../testrigs-dsf.yaml | 40 +-- .../apitestrig-esignet-mosipid1-setup.sh | 2 +- .../apitestrig-esignet-mosipid2-setup.sh | 2 +- .../apitestrig-esignet-setup.sh | 2 +- .../apitestrig-esignet-sunbird-setup.sh | 2 +- .../captcha-postinstall.sh | 22 +- .../config-server-esignet-postinstall.sh | 12 +- .../config-server-esignet-setup.sh | 2 +- .../esignet-db-postinstall.sh | 2 +- .../esignet-init-db.sh | 2 +- .../esignet-misp-onboarder-postinstall.sh | 8 +- .../esignet-misp-onboarder-preinstall.sh | 2 +- .../esignet-mock-rp-onboarder-postinstall.sh | 2 +- .../esignet-mock-rp-onboarder-preinstall.sh | 2 +- .../esignet-mosipid1-preinstall.sh | 22 +- .../esignet-mosipid2-preinstall.sh | 22 +- .../esignet-postinstall-keycloak-init.sh | 4 +- .../esignet-preinstall.sh | 4 +- .../esignet-sunbird-preinstall.sh | 22 +- .../kafka-postinstall.sh | 2 +- .../keycloak-postinstall.sh | 2 +- .../mock-identity-init-db.sh | 2 +- .../mock-identity-system-preinstall.sh | 14 +- ...lying-party-service-mosipid1-preinstall.sh | 2 +- ...lying-party-service-mosipid2-preinstall.sh | 2 +- .../mock-relying-party-service-preinstall.sh | 2 +- ...elying-party-service-sunbird-preinstall.sh | 2 +- ...ck-relying-party-ui-mosipid1-preinstall.sh | 2 +- ...ck-relying-party-ui-mosipid2-preinstall.sh | 2 +- .../mock-relying-party-ui-preinstall.sh | 4 +- ...ock-relying-party-ui-sunbird-preinstall.sh | 2 +- .../oidc-ui-mosipid1-preinstall.sh | 2 +- .../oidc-ui-mosipid2-preinstall.sh | 2 +- .../oidc-ui-preinstall.sh | 2 +- .../oidc-ui-sunbird-preinstall.sh | 2 +- .../pms-partner-mosipid1-preinstall.sh | 8 +- .../pms-partner-mosipid2-preinstall.sh | 8 +- .../postgres-preinstall.sh | 2 +- .../esignet-standalone-2.0.0/redis-setup.sh | 2 +- .../softhsm-esignet-mosipid1-setup.sh | 2 +- .../softhsm-esignet-mosipid2-setup.sh | 2 +- .../softhsm-esignet-postinstall.sh | 10 +- .../softhsm-esignet-setup.sh | 2 +- .../softhsm-esignet-sunbird-setup.sh | 2 +- ...ofthsm-mock-identity-system-postinstall.sh | 10 +- .../trigger-test-jobs-esignet.sh | 16 +- .../config-server-esignet-values-2-0-0.yaml | 6 +- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 4 +- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 4 +- .../esignet-plugin-values-2-0-0.yaml | 6 +- .../esignet-sunbird-plugin-values-2-0-0.yaml | 4 +- .../mock-identity-values-2-0-0.yaml | 2 +- 54 files changed, 288 insertions(+), 282 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 4603e6237..170fb368f 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -582,12 +582,18 @@ jobs: SKIP_RELEASES_ARG="" if [[ "$PROFILE" == esignet-standalone* ]]; then case "$PROFILE" in - esignet-standalone) NS_SUFFIX="" ;; - esignet-standalone-2.0.0) NS_SUFFIX="-2-0-0" ;; - *) NS_SUFFIX="" ;; + esignet-standalone) + SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid1:esignet-mosipid1" "esignet-softhsm-mosipid2:esignet-mosipid2" "esignet-softhsm-sunbird:esignet-sunbird") + ;; + esignet-standalone-2.0.0) + SOFTHSM_PAIRS=("esignet-softhsm-go:esignet-go-mock" "esignet-softhsm-go-mosipid1:esignet-go-mosipid1" "esignet-softhsm-go-mosipid2:esignet-go-mosipid2" "esignet-softhsm-go-sunbird:esignet-go-sunbird") + ;; + *) + SOFTHSM_PAIRS=() + ;; esac SKIP_RELEASES="" - for pair in "esignet-softhsm${NS_SUFFIX}:esignet-mock${NS_SUFFIX}" "esignet-softhsm-mosipid1${NS_SUFFIX}:esignet-mosipid1${NS_SUFFIX}" "esignet-softhsm-mosipid2${NS_SUFFIX}:esignet-mosipid2${NS_SUFFIX}" "esignet-softhsm-sunbird${NS_SUFFIX}:esignet-sunbird${NS_SUFFIX}"; do + for pair in "${SOFTHSM_PAIRS[@]}"; do release="${pair%%:*}" ns="${pair##*:}" if helm status "$release" -n "$ns" &>/dev/null; then diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 38d63748b..0d45c0c3b 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -28,15 +28,15 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm namespaces: - esignet-mock-2-0-0: + esignet-go-mock: protected: false softhsm-2-0-0: protected: false - esignet-mosipid1-2-0-0: + esignet-go-mosipid1: protected: false - esignet-mosipid2-2-0-0: + esignet-go-mosipid2: protected: false - esignet-sunbird-2-0-0: + esignet-go-sunbird: protected: false apps: @@ -45,8 +45,8 @@ apps: # --------------------------------------------------------------------------- # Deployed here (not in external-dsf) so esignet-softhsm-share configmap is # available in esignet namespace before eSignet service starts. - esignet-softhsm-2-0-0: - namespace: esignet-mock-2-0-0 + esignet-softhsm-go: + namespace: esignet-go-mock enabled: true version: 12.0.1 chart: mosip/softhsm @@ -56,8 +56,8 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" - esignet-softhsm-mosipid1-2-0-0: - namespace: esignet-mosipid1-2-0-0 + esignet-softhsm-go-mosipid1: + namespace: esignet-go-mosipid1 enabled: true version: 12.0.1 chart: mosip/softhsm @@ -67,8 +67,8 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh" - esignet-softhsm-mosipid2-2-0-0: - namespace: esignet-mosipid2-2-0-0 + esignet-softhsm-go-mosipid2: + namespace: esignet-go-mosipid2 enabled: ${MOSIPID2_ENABLED} version: 12.0.1 chart: mosip/softhsm @@ -78,8 +78,8 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh" - esignet-softhsm-sunbird-2-0-0: - namespace: esignet-sunbird-2-0-0 + esignet-softhsm-go-sunbird: + namespace: esignet-go-sunbird enabled: true version: 12.0.1 chart: mosip/softhsm @@ -90,7 +90,7 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh" esignet-config-server-2-0-0: - namespace: esignet-mock-2-0-0 + namespace: esignet-go-mock enabled: false version: 12.0.1 chart: mosip/config-server @@ -105,8 +105,8 @@ apps: # --------------------------------------------------------------------------- # eSignet v1.7.1 # --------------------------------------------------------------------------- - esignet-mock-2-0-0: - namespace: esignet-mock-2-0-0 + esignet-go-mock: + namespace: esignet-go-mock enabled: true version: 0.0.1-develop chart: mosip/esignet @@ -119,7 +119,7 @@ apps: activeProfileEnv: "" pluginNameEnv: "esignet-mock-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-2-0-0-share" + extraEnvVarsCM[0]: "esignet-softhsm-go-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" domainConfig.MOSIP_ESIGNET_HOST: "esignet-2-0-0.${domain_name}" @@ -137,8 +137,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh" - esignet-mosipid1-2-0-0: - namespace: esignet-mosipid1-2-0-0 + esignet-go-mosipid1: + namespace: esignet-go-mosipid1 enabled: true version: 0.1.0-develop chart: mosip/esignet @@ -151,11 +151,11 @@ apps: activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid1-2-0-0-share" + extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid1-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid1-2-0-0.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid1-2-0-0.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid1.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid1.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" @@ -170,15 +170,15 @@ apps: domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid1_domain_name}/v1/authmanager/authenticate/clientidsecretkey" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid1_domain_name}/v1/auditmanager/audits" domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid1-2-0-0.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid1-2-0-0.${domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid1.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid1.${domain_name}" timeout: 600 priority: -14 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh" - esignet-mosipid2-2-0-0: - namespace: esignet-mosipid2-2-0-0 + esignet-go-mosipid2: + namespace: esignet-go-mosipid2 enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/esignet @@ -191,11 +191,11 @@ apps: activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid2-2-0-0-share" + extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid2-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid2-2-0-0.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid2-2-0-0.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid2.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid2.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" @@ -210,15 +210,15 @@ apps: domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid2_domain_name}/v1/authmanager/authenticate/clientidsecretkey" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid2_domain_name}/v1/auditmanager/audits" domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid2-2-0-0.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid2-2-0-0.${domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid2.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid2.${domain_name}" timeout: 600 priority: -14 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh" - esignet-sunbird-2-0-0: - namespace: esignet-sunbird-2-0-0 + esignet-go-sunbird: + namespace: esignet-go-sunbird enabled: true version: 0.0.1-develop chart: mosip/esignet @@ -231,11 +231,11 @@ apps: activeProfileEnv: "" pluginNameEnv: "sunbird-rc-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-sunbird-2-0-0-share" + extraEnvVarsCM[0]: "esignet-softhsm-go-sunbird-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-sunbird-2-0-0.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-sunbird-2-0-0.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-sunbird.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-go-sunbird.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" @@ -255,7 +255,7 @@ apps: # OIDC UI v1.7.1 # --------------------------------------------------------------------------- oidc-ui-2-0-0: - namespace: esignet-mock-2-0-0 + namespace: esignet-go-mock enabled: true version: 0.0.1-develop chart: mosip/oidc-ui @@ -263,60 +263,60 @@ apps: image.repository: "mosipqa/oidc-ui" image.tag: "develop" istio.hosts[0]: "esignet-2-0-0.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mock-2-0-0.esignet-mock-2-0-0" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mock-2-0-0.esignet-mock-2-0-0/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mock-2-0-0.esignet-mock-2-0-0" + oidc_ui.oidc_service_host: "esignet-go-mock.esignet-go-mock" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mock.esignet-go-mock" timeout: 1200 priority: -13 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" - oidc-ui-mosipid1-2-0-0: - namespace: esignet-mosipid1-2-0-0 + oidc-ui-go-mosipid1: + namespace: esignet-go-mosipid1 enabled: true version: 0.1.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop" - istio.hosts[0]: "esignet-mosipid1-2-0-0.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mosipid1-2-0-0.esignet-mosipid1-2-0-0" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid1-2-0-0.esignet-mosipid1-2-0-0/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid1-2-0-0.esignet-mosipid1-2-0-0" + istio.hosts[0]: "esignet-go-mosipid1.${domain_name}" + oidc_ui.oidc_service_host: "esignet-go-mosipid1.esignet-go-mosipid1" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mosipid1.esignet-go-mosipid1" timeout: 1200 priority: -13 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh" - oidc-ui-mosipid2-2-0-0: - namespace: esignet-mosipid2-2-0-0 + oidc-ui-go-mosipid2: + namespace: esignet-go-mosipid2 enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop" - istio.hosts[0]: "esignet-mosipid2-2-0-0.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mosipid2-2-0-0.esignet-mosipid2-2-0-0" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid2-2-0-0.esignet-mosipid2-2-0-0/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid2-2-0-0.esignet-mosipid2-2-0-0" + istio.hosts[0]: "esignet-go-mosipid2.${domain_name}" + oidc_ui.oidc_service_host: "esignet-go-mosipid2.esignet-go-mosipid2" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mosipid2.esignet-go-mosipid2" timeout: 1200 priority: -13 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh" - oidc-ui-sunbird-2-0-0: - namespace: esignet-sunbird-2-0-0 + oidc-ui-go-sunbird: + namespace: esignet-go-sunbird enabled: true version: 0.0.1-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "1.8.x" - istio.hosts[0]: "esignet-sunbird-2-0-0.${domain_name}" - oidc_ui.oidc_service_host: "esignet-sunbird-2-0-0.esignet-sunbird-2-0-0" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-sunbird-2-0-0.esignet-sunbird-2-0-0/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-sunbird-2-0-0.esignet-sunbird-2-0-0" + istio.hosts[0]: "esignet-go-sunbird.${domain_name}" + oidc_ui.oidc_service_host: "esignet-go-sunbird.esignet-go-sunbird" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-sunbird.esignet-go-sunbird" timeout: 1200 priority: -13 hooks: @@ -326,7 +326,7 @@ apps: # Mock Identity System (Optional) # --------------------------------------------------------------------------- # Enable for testing with mock identity data. - softhsm-mock-identity-system-2-0-0: + softhsm-mock-identity-system-go: namespace: softhsm-2-0-0 enabled: true version: 12.0.1 @@ -342,7 +342,7 @@ apps: postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh" mock-identity-system-2-0-0: - namespace: esignet-mock-2-0-0 + namespace: esignet-go-mock enabled: true version: 0.0.1-develop chart: mosip/mock-identity-system @@ -351,7 +351,7 @@ apps: image.repository: "mosipqa/mock-identity-system" image.tag: "develop" enable_insecure: "false" - extraEnvVarsCM[0]: "softhsm-mock-identity-system-2-0-0-share" + extraEnvVarsCM[0]: "softhsm-mock-identity-system-go-share" domainConfig.MOSIP_ESIGNET_HOST: "esignet-2-0-0.${domain_name}" domainConfig.MOSIP_SIGNUP_HOST: "signup-2-0-0.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" @@ -372,12 +372,12 @@ apps: # Mock Relying Party (Optional) # --------------------------------------------------------------------------- mock-relying-party-service-2-0-0: - namespace: esignet-mock-2-0-0 + namespace: esignet-go-mock enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mock-2-0-0.esignet-mock-2-0-0/v1/esignet" + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-2-0-0.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" @@ -386,14 +386,14 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" - mock-relying-party-service-mosipid1-2-0-0: - namespace: esignet-mosipid1-2-0-0 + mock-relying-party-service-go-mosipid1: + namespace: esignet-go-mosipid1 enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid1-2-0-0.esignet-mosipid1-2-0-0/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid1-2-0-0.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -401,14 +401,14 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh" - mock-relying-party-service-mosipid2-2-0-0: - namespace: esignet-mosipid2-2-0-0 + mock-relying-party-service-go-mosipid2: + namespace: esignet-go-mosipid2 enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/mock-relying-party-service set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid2-2-0-0.esignet-mosipid2-2-0-0/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid2-2-0-0.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -416,14 +416,14 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh" - mock-relying-party-service-sunbird-2-0-0: - namespace: esignet-sunbird-2-0-0 + mock-relying-party-service-go-sunbird: + namespace: esignet-go-sunbird enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-sunbird-2-0-0.esignet-sunbird-2-0-0/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-sunbird-2-0-0.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -432,13 +432,13 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh" mock-relying-party-ui-2-0-0: - namespace: esignet-mock-2-0-0 + namespace: esignet-go-mock enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-2-0-0.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-2-0-0.esignet-mock-2-0-0" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-2-0-0.esignet-go-mock" mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-2-0-0.${domain_name}" mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-2-0-0.${domain_name}/mock-relying-party-service" mock_relying_party_ui.REDIRECT_URI: "https://healthservices-2-0-0.${domain_name}/userprofile" @@ -451,68 +451,68 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh" - mock-relying-party-ui-mosipid1-2-0-0: - namespace: esignet-mosipid1-2-0-0 + mock-relying-party-ui-go-mosipid1: + namespace: esignet-go-mosipid1 enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid1-2-0-0.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid1-2-0-0.esignet-mosipid1-2-0-0" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid1-2-0-0.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid1-2-0-0.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1-2-0-0.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1-2-0-0.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1-2-0-0.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-mosipid1-2-0-0.${domain_name}" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-mosipid1.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-mosipid1.esignet-go-mosipid1" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-mosipid1.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-mosipid1.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid1.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + istio.hosts[0]: "healthservices-go-mosipid1.${domain_name}" wait: true timeout: 480 priority: -9 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh" - mock-relying-party-ui-mosipid2-2-0-0: - namespace: esignet-mosipid2-2-0-0 + mock-relying-party-ui-go-mosipid2: + namespace: esignet-go-mosipid2 enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid2-2-0-0.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid2-2-0-0.esignet-mosipid2-2-0-0" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid2-2-0-0.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid2-2-0-0.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2-2-0-0.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2-2-0-0.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2-2-0-0.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-mosipid2-2-0-0.${domain_name}" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-mosipid2.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-mosipid2.esignet-go-mosipid2" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-mosipid2.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-mosipid2.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid2.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" + istio.hosts[0]: "healthservices-go-mosipid2.${domain_name}" wait: true timeout: 480 priority: -9 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh" - mock-relying-party-ui-sunbird-2-0-0: - namespace: esignet-sunbird-2-0-0 + mock-relying-party-ui-go-sunbird: + namespace: esignet-go-sunbird enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-sunbird-2-0-0.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-sunbird-2-0-0.esignet-sunbird-2-0-0" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-sunbird-2-0-0.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-sunbird-2-0-0.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird-2-0-0.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird-2-0-0.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird-2-0-0.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-sunbird-2-0-0.${domain_name}" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-sunbird.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-sunbird.esignet-go-sunbird" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-sunbird.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-sunbird.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-sunbird.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + istio.hosts[0]: "healthservices-go-sunbird.${domain_name}" wait: true timeout: 480 priority: -9 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-mosipid1-2-0-0: - namespace: esignet-mosipid1-2-0-0 + pms-partner-go-mosipid1: + namespace: esignet-go-mosipid1 enabled: false version: 12.2.3 chart: mosip/pms-partner @@ -520,7 +520,7 @@ apps: # image.repository: "mosipid/partner-management-service" # image.tag: "1.2.2.3" istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1-2-0-0.${domain_name}" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid1.${domain_name}" extraEnvVarsCM[0]: "esignet-global" extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" priority: -9 @@ -528,8 +528,8 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh" - pms-policy-mosipid1-2-0-0: - namespace: esignet-mosipid1-2-0-0 + pms-policy-go-mosipid1: + namespace: esignet-go-mosipid1 enabled: false version: 12.2.3 chart: mosip/pms-policy @@ -537,14 +537,14 @@ apps: # image.repository: "mosipid/policy-management-service" # image.tag: "1.2.2.2" istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1-2-0-0.${domain_name}" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid1.${domain_name}" extraEnvVarsCM[0]: "esignet-global" extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" priority: -9 timeout: 1200 - pms-partner-mosipid2-2-0-0: - namespace: esignet-mosipid2-2-0-0 + pms-partner-go-mosipid2: + namespace: esignet-go-mosipid2 enabled: false version: 12.2.3 chart: mosip/pms-partner @@ -552,7 +552,7 @@ apps: # image.repository: "mosipid/partner-management-service" # image.tag: "1.2.2.3" istio.gateways[0]: "pms-partner-mosipid2-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2-2-0-0.${domain_name}" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid2.${domain_name}" extraEnvVarsCM[0]: "esignet-global" extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" priority: -9 @@ -560,8 +560,8 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh" - pms-policy-mosipid2-2-0-0: - namespace: esignet-mosipid2-2-0-0 + pms-policy-go-mosipid2: + namespace: esignet-go-mosipid2 enabled: false version: 12.2.3 chart: mosip/pms-policy @@ -571,7 +571,7 @@ apps: istio.gateways[0]: "pms-partner-mosipid2-gateway" extraEnvVarsCM[0]: "esignet-global" extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2-2-0-0.${domain_name}" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid2.${domain_name}" priority: -9 timeout: 1200 @@ -587,7 +587,7 @@ apps: # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. # After completion, restarts the esignet deployment to pick up the new MISP license key. esignet-misp-onboarder-2-0-0: - namespace: esignet-mock-2-0-0 + namespace: esignet-go-mock enabled: false version: 0.0.1-develop chart: mosip/partner-onboarder @@ -599,7 +599,7 @@ apps: onboarding.configmaps.s3.s3-region: "" onboarding.configmaps.s3.s3-bucket-name: "onboarder" onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock-2-0-0" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-go-mock" onboarding.variables.push_reports_to_s3: "true" onboarding.variables.mosipid: "false" extraEnvVarsCM[0]: "keycloak-env-vars" @@ -626,7 +626,7 @@ apps: # Onboards the mock relying party as an OIDC client. # Enable for plugin 1 (mock) or plugin 3 (sunbird-rc). Set mosipid: "true" for mosip-identity-plugin. esignet-mock-rp-onboarder-2-0-0: - namespace: esignet-mock-2-0-0 + namespace: esignet-go-mock enabled: true version: 0.0.1-develop chart: mosip/partner-onboarder @@ -640,7 +640,7 @@ apps: onboarding.configmaps.s3.s3-region: "" onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" onboarding.configmaps.s3.s3-bucket-name: "onboarder" - onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock-2-0-0" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-go-mock" onboarding.variables.mosipid: "false" onboarding.variables.push_reports_to_s3: "true" extraEnvVarsCM[0]: "keycloak-env-vars" diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index 78a6076cb..889356da1 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -15,13 +15,13 @@ helmRepos: # esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) # signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) namespaces: - esignet-mosipid1-2-0-0: + esignet-go-mosipid1: protected: false - esignet-mock-2-0-0: + esignet-go-mock: protected: false - esignet-mosipid2-2-0-0: + esignet-go-mosipid2: protected: false - esignet-sunbird-2-0-0: + esignet-go-sunbird: protected: false signup-2-0-0: protected: false @@ -33,7 +33,7 @@ apps: # eSignet API Testrig — main esignet namespace # --------------------------------------------------------------------------- esignet-apitestrig-2-0-0: - namespace: esignet-mock-2-0-0 + namespace: esignet-go-mock enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -61,7 +61,7 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mock-2-0-0" + apitestrig.configmaps.apitestrig.NS: "esignet-go-mock" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" @@ -77,8 +77,8 @@ apps: # --------------------------------------------------------------------------- # eSignet API Testrig — esignet-mosipid1 namespace (mosip-identity-plugin) # --------------------------------------------------------------------------- - esignet-mosipid1-apitestrig-2-0-0: - namespace: esignet-mosipid1-2-0-0 + esignet-go-mosipid1-apitestrig: + namespace: esignet-go-mosipid1 enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -106,14 +106,14 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid1-2-0-0" + apitestrig.configmaps.apitestrig.NS: "esignet-go-mosipid1" apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid1-2-0-0.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-mosipid1.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid1_domain_name};idrepository=api-internal.${mosipid1_domain_name};authmanager=api-internal.${mosipid1_domain_name};resident=api-internal.${mosipid1_domain_name};partnermanager=pms-mosipid1-2-0-0.${mosipid1_domain_name};idauthentication=api-internal.${mosipid1_domain_name};masterdata=api-internal.${mosipid1_domain_name};idgenerator=api-internal.${mosipid1_domain_name};policymanager=pms-mosipid1-2-0-0.${mosipid1_domain_name};preregistration=api-internal.${mosipid1_domain_name};keymanager=api-internal.${mosipid1_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid1_domain_name};idrepository=api-internal.${mosipid1_domain_name};authmanager=api-internal.${mosipid1_domain_name};resident=api-internal.${mosipid1_domain_name};partnermanager=pms-go-mosipid1.${mosipid1_domain_name};idauthentication=api-internal.${mosipid1_domain_name};masterdata=api-internal.${mosipid1_domain_name};idgenerator=api-internal.${mosipid1_domain_name};policymanager=pms-go-mosipid1.${mosipid1_domain_name};preregistration=api-internal.${mosipid1_domain_name};keymanager=api-internal.${mosipid1_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -4 @@ -123,8 +123,8 @@ apps: # --------------------------------------------------------------------------- # eSignet API Testrig — esignet-mosipid2 namespace (mosip-identity-plugin) # --------------------------------------------------------------------------- - esignet-mosipid2-apitestrig-2-0-0: - namespace: esignet-mosipid2-2-0-0 + esignet-go-mosipid2-apitestrig: + namespace: esignet-go-mosipid2 enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -152,14 +152,14 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid2-2-0-0" + apitestrig.configmaps.apitestrig.NS: "esignet-go-mosipid2" apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid2-2-0-0.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-mosipid2.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid2_domain_name};idrepository=api-internal.${mosipid2_domain_name};authmanager=api-internal.${mosipid2_domain_name};resident=api-internal.${mosipid2_domain_name};partnermanager=pms-mosipid2-2-0-0.${mosipid2_domain_name};idauthentication=api-internal.${mosipid2_domain_name};masterdata=api-internal.${mosipid2_domain_name};idgenerator=api-internal.${mosipid2_domain_name};policymanager=pms-mosipid2-2-0-0.${mosipid2_domain_name};preregistration=api-internal.${mosipid2_domain_name};keymanager=api-internal.${mosipid2_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid2_domain_name};idrepository=api-internal.${mosipid2_domain_name};authmanager=api-internal.${mosipid2_domain_name};resident=api-internal.${mosipid2_domain_name};partnermanager=pms-go-mosipid2.${mosipid2_domain_name};idauthentication=api-internal.${mosipid2_domain_name};masterdata=api-internal.${mosipid2_domain_name};idgenerator=api-internal.${mosipid2_domain_name};policymanager=pms-go-mosipid2.${mosipid2_domain_name};preregistration=api-internal.${mosipid2_domain_name};keymanager=api-internal.${mosipid2_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -3 @@ -170,8 +170,8 @@ apps: # eSignet API Testrig — esignet-sunbird namespace (sunbird-rc-plugin) # postInstall triggers all four testrig namespaces after last one deploys. # --------------------------------------------------------------------------- - esignet-sunbird-apitestrig-2-0-0: - namespace: esignet-sunbird-2-0-0 + esignet-go-sunbird-apitestrig: + namespace: esignet-go-sunbird enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -199,12 +199,12 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-sunbird-2-0-0" + apitestrig.configmaps.apitestrig.NS: "esignet-go-sunbird" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-sunbird-2-0-0.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-sunbird.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid1_domain_name}" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh index 345ea71b0..adbdcadfb 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh @@ -9,7 +9,7 @@ # ============================================================================= set -euo pipefail -NS=esignet-mosipid1-2-0-0 +NS=esignet-go-mosipid1 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh index ffa4f388d..bb5f2d9e2 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh @@ -9,7 +9,7 @@ # ============================================================================= set -euo pipefail -NS=esignet-mosipid2-2-0-0 +NS=esignet-go-mosipid2 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh index 7c4e87add..de0fb532e 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh @@ -9,7 +9,7 @@ # ============================================================================= set -euo pipefail -NS=esignet-mock-2-0-0 +NS=esignet-go-mock COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh index e5ade4121..1a58942ea 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh @@ -9,7 +9,7 @@ # ============================================================================= set -euo pipefail -NS=esignet-sunbird-2-0-0 +NS=esignet-go-sunbird COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh index 2d0f4267e..938217c8c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh @@ -13,7 +13,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" CAPTCHA_NS="captcha" CAPTCHA_SITE_KEY="${ESIGNET_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_CAPTCHA_SITE_KEY environment variable must be set}" CAPTCHA_SECRET_KEY="${ESIGNET_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_CAPTCHA_SECRET_KEY environment variable must be set}" @@ -24,22 +24,22 @@ echo "eSignet 1.7.1 - Captcha Post-install" echo "================================================" # --- Step 1: Create captcha secrets for eSignet --- -echo "Creating esignet-captcha-2-0-0 secret in $ESIGNET_NS namespace" -kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha-2-0-0 \ - --from-literal=esignet-captcha-2-0-0-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=esignet-captcha-2-0-0-secret-key="$CAPTCHA_SECRET_KEY" \ +echo "Creating esignet-captcha-go secret in $ESIGNET_NS namespace" +kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha-go \ + --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - # --- Step 2: Copy captcha secret to captcha namespace --- -echo "Copying esignet-captcha-2-0-0 secret to $CAPTCHA_NS namespace" -$COPY_UTIL secret esignet-captcha-2-0-0 "$ESIGNET_NS" "$CAPTCHA_NS" +echo "Copying esignet-captcha-go secret to $CAPTCHA_NS namespace" +$COPY_UTIL secret esignet-captcha-go "$ESIGNET_NS" "$CAPTCHA_NS" # --- Step 3: Patch captcha deployment with secret env var --- echo "Patching captcha deployment with secret key environment variable" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_2_0_0')].name}" 2>/dev/null || echo "") +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then - echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_2_0_0 env var..." + echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var..." ENV_ARRAY_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ -o jsonpath="{.spec.template.spec.containers[0].env}" 2>/dev/null || echo "") if [[ -z "$ENV_ARRAY_EXISTS" ]]; then @@ -48,9 +48,9 @@ if [[ -z "$ENV_VAR_EXISTS" ]]; then -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env", "value": []}]' fi kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_2_0_0", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-2-0-0", "key": "esignet-captcha-2-0-0-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_2_0_0 env var already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var already exists." fi echo "Captcha post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh index 974350f08..9411a9f6b 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh @@ -12,7 +12,7 @@ # ============================================================================= set -euo pipefail -SOURCE_NS="esignet-mock-2-0-0" +SOURCE_NS="esignet-go-mock" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" CM_NAME="esignet-config-server-2-0-0-share" @@ -23,17 +23,17 @@ echo "================================================" echo "eSignet 1.7.1 - Config-Server eSignet Post-install" echo "================================================" -for TARGET_NS in esignet-mosipid1-2-0-0 esignet-mosipid2-2-0-0 esignet-sunbird-2-0-0; do +for TARGET_NS in esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" done -echo "Patching $CM_NAME in esignet-mosipid1-2-0-0 (active_profile_env=mosipid1, spring_config_label_env=$MOSIPID1_SPRING_LABEL)" -kubectl -n esignet-mosipid1-2-0-0 patch configmap "$CM_NAME" --type merge \ +echo "Patching $CM_NAME in esignet-go-mosipid1 (active_profile_env=mosipid1, spring_config_label_env=$MOSIPID1_SPRING_LABEL)" +kubectl -n esignet-go-mosipid1 patch configmap "$CM_NAME" --type merge \ -p "{\"data\":{\"active_profile_env\":\"mosipid1\",\"spring_config_label_env\":\"$MOSIPID1_SPRING_LABEL\"}}" -echo "Patching $CM_NAME in esignet-mosipid2-2-0-0 (active_profile_env=mosipid2, spring_config_label_env=$MOSIPID2_SPRING_LABEL)" -kubectl -n esignet-mosipid2-2-0-0 patch configmap "$CM_NAME" --type merge \ +echo "Patching $CM_NAME in esignet-go-mosipid2 (active_profile_env=mosipid2, spring_config_label_env=$MOSIPID2_SPRING_LABEL)" +kubectl -n esignet-go-mosipid2 patch configmap "$CM_NAME" --type merge \ -p "{\"data\":{\"active_profile_env\":\"mosipid2\",\"spring_config_label_env\":\"$MOSIPID2_SPRING_LABEL\"}}" echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh index 47bf68be8..859698796 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh @@ -29,7 +29,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh index 863bd0b9f..27b7e4a3d 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh @@ -15,7 +15,7 @@ echo "================================================" echo "eSignet 1.7.1 - Database Init Post-install" echo "================================================" -for NS in esignet-mock-2-0-0 esignet-mosipid1-2-0-0 esignet-mosipid2-2-0-0 esignet-sunbird-2-0-0; do +for NS in esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do echo "Copying db-common-secrets from $POSTGRES_NS to $NS" $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$NS" done diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh index 02d2c433d..c597726bc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh @@ -15,7 +15,7 @@ echo "================================================" echo "eSignet 1.7.1 - Database Init Pre-install" echo "================================================" -for NS in esignet-mock-2-0-0 esignet-mosipid1-2-0-0 esignet-mosipid2-2-0-0 esignet-sunbird-2-0-0; do +for NS in esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - kubectl label namespace "$NS" istio-injection=enabled --overwrite echo "Namespace $NS ready." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index 02e4c7929..569bd9ed8 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -8,7 +8,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" echo "================================================" echo "eSignet 1.7.1 - MISP Onboarder Post-install" @@ -40,9 +40,9 @@ else echo "esignet-config-server-2-0-0 deployment not found — skipping restart." fi -if kubectl -n "$ESIGNET_NS" get deployment esignet-mock-2-0-0 &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-mock-2-0-0 - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-mock-2-0-0 --timeout=300s || \ +if kubectl -n "$ESIGNET_NS" get deployment esignet-go-mock &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-go-mock + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s || \ echo "WARNING: esignet rollout did not complete within timeout." >&2 echo "esignet deployment restarted." else diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh index af5993f20..72baca851 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -12,7 +12,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh index 6780d27bc..e453c0c59 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh @@ -7,7 +7,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" echo "================================================" echo "eSignet 1.7.1 - Mock RP Onboarder Post-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh index 262bd4a32..14d494299 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh @@ -7,7 +7,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh index 80cb4359a..d9488356b 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh @@ -3,13 +3,13 @@ # eSignet 1.7.1 - eSignet MOSIPID1 Service Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid1, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-mosipid1-2-0-0 secret +# postgres + redis config/secrets), then creates esignet-captcha-go-mosipid1 secret # in the captcha namespace from workflow env vars, copies it to esignet-mosipid1, # and patches the captcha deployment with the MOSIPID1 secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1-2-0-0" +export ESIGNET_NS="esignet-go-mosipid1" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY must be set}" @@ -24,11 +24,11 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-mosipid1-2-0-0.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-go-mosipid1.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-mosipid1-2-0-0.${domain_name}" \ + --from-literal=mosip-signup-host="signup-go-mosipid1.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - @@ -44,23 +44,23 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-mosipid1-2-0-0 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid1-2-0-0 \ +echo "Creating esignet-captcha-go-mosipid1 secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid1 \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-mosipid1-2-0-0 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-mosipid1-2-0-0 "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-go-mosipid1 secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-go-mosipid1 "$CAPTCHA_NS" "$ESIGNET_NS" echo "Patching captcha deployment with ESIGNETMOSIPID1 secret key" ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1_2_0_0')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1_2_0_0", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid1-2-0-0", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-mosipid1", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1_2_0_0 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1 already exists." fi # --- postgres-postgresql-mosipid1 secret (MOSIPID1 remote postgres password) --- diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh index 5ce7ae6c5..c4ea74a2c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh @@ -3,13 +3,13 @@ # eSignet 1.7.1 - eSignet MOSIPID2 Service Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid2, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-mosipid2-2-0-0 secret +# postgres + redis config/secrets), then creates esignet-captcha-go-mosipid2 secret # in the captcha namespace from workflow env vars, copies it to esignet-mosipid2, # and patches the captcha deployment with the MOSIPID2 secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid2-2-0-0" +export ESIGNET_NS="esignet-go-mosipid2" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY must be set}" @@ -24,11 +24,11 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-mosipid2-2-0-0.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-go-mosipid2.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-mosipid2-2-0-0.${domain_name}" \ + --from-literal=mosip-signup-host="signup-go-mosipid2.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - @@ -44,23 +44,23 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-mosipid2-2-0-0 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid2-2-0-0 \ +echo "Creating esignet-captcha-go-mosipid2 secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid2 \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-mosipid2-2-0-0 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-mosipid2-2-0-0 "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-go-mosipid2 secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-go-mosipid2 "$CAPTCHA_NS" "$ESIGNET_NS" echo "Patching captcha deployment with ESIGNETMOSIPID2 secret key" ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2_2_0_0')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2_2_0_0", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid2-2-0-0", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-mosipid2", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2_2_0_0 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2 already exists." fi # --- postgres-postgresql-mosipid2 secret (MOSIPID2 remote postgres password) --- diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh index 856de8ab0..e79d80caf 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh @@ -10,13 +10,13 @@ KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" # All esignet-mock namespaces that need keycloak resources -ESIGNET_NAMESPACES=(esignet-mock-2-0-0 esignet-mosipid1-2-0-0 esignet-mosipid2-2-0-0 esignet-sunbird-2-0-0) +ESIGNET_NAMESPACES=(esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird) echo "================================================" echo "eSignet 1.7.1 - Keycloak Init Post-install" echo "================================================" -echo "Sharing keycloak resources from $KEYCLOAK_NS to all esignet-mock-2-0-0 namespaces" +echo "Sharing keycloak resources from $KEYCLOAK_NS to all esignet-go-mock namespaces" for NS_TARGET in "${ESIGNET_NAMESPACES[@]}"; do if ! kubectl get namespace "$NS_TARGET" &>/dev/null; then echo "Namespace $NS_TARGET does not exist, skipping" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index 804e012eb..af0d8b6ce 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -14,7 +14,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" POSTGRES_NS="postgres" REDIS_NS="redis" KEYCLOAK_NS="keycloak" @@ -65,7 +65,7 @@ $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" # external-dsf.yaml esignet-keycloak-init release), but that hook's namespace loop only # covers the original esignet-standalone namespaces. Copy them directly here so the # 2.0.0 namespace is self-sufficient without touching the shared hook. This runs for -# every instance that delegates to this script (esignet-mock-2-0-0 plus the +# every instance that delegates to this script (esignet-go-mock plus the # mosipid1/mosipid2/sunbird wrappers), matching the original profile's fan-out to all # four namespaces. echo "Copying keycloak-host configmap from $KEYCLOAK_NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh index 548d950c4..25f3e4a7e 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh @@ -3,13 +3,13 @@ # eSignet 1.7.1 - eSignet Sunbird Service Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-sunbird, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-sunbird-2-0-0 secret +# postgres + redis config/secrets), then creates esignet-captcha-go-sunbird secret # in the captcha namespace from workflow env vars, copies it to esignet-sunbird, # and patches the captcha deployment with the Sunbird secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-sunbird-2-0-0" +export ESIGNET_NS="esignet-go-sunbird" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" CAPTCHA_SITE_KEY="${ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY must be set}" @@ -22,11 +22,11 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-sunbird-2-0-0.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-go-sunbird.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-sunbird-2-0-0.${domain_name}" \ + --from-literal=mosip-signup-host="signup-go-sunbird.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - @@ -42,23 +42,23 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-sunbird-2-0-0 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-sunbird-2-0-0 \ +echo "Creating esignet-captcha-go-sunbird secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-sunbird \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-sunbird-2-0-0 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-sunbird-2-0-0 "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-go-sunbird secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-go-sunbird "$CAPTCHA_NS" "$ESIGNET_NS" echo "Patching captcha deployment with ESIGNETSUNBIRD secret key" ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD_2_0_0')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD_2_0_0", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-sunbird-2-0-0", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-sunbird", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD_2_0_0 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD already exists." fi echo "eSignet Sunbird pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh index 97259f342..14e0b8eb9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" KAFKA_URL="${KAFKA_URL:-kafka-0.kafka-headless.kafka.svc.cluster.local:9092,kafka-1.kafka-headless.kafka.svc.cluster.local:9092,kafka-2.kafka-headless.kafka.svc.cluster.local:9092}" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh index 9c371a90d..6e4fbedf1 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh @@ -13,7 +13,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" KEYCLOAK_NS="keycloak" CHART_VERSION="${KEYCLOAK_INIT_VERSION:-12.0.2}" INSTALLATION_DOMAIN="${INSTALLATION_DOMAIN:-sandbox.xyz.net}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh index fd47fd8aa..9d22608cd 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh index 14ee1ed42..d1f460dad 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -5,7 +5,7 @@ # Prepares esignet namespace for mock identity system deployment: # - Copies softhsm-mock-identity-system secret from softhsm ns # - Creates mockid-postgres-config with mock identity DB values -# - Verifies softhsm-mock-identity-system-2-0-0-share ConfigMap is present +# - Verifies softhsm-mock-identity-system-go-share ConfigMap is present # # Environment Variables: # MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem) @@ -14,7 +14,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" SOFTHSM_NS="softhsm-2-0-0" MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem_2_0_0}" MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser_2_0_0}" @@ -29,8 +29,8 @@ kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply # Copy softhsm-mock-identity-system secret to esignet ns # The chart references it directly via secretKeyRef — pod and secret must be in same namespace -$COPY_UTIL secret softhsm-mock-identity-system-2-0-0 "$SOFTHSM_NS" "$ESIGNET_NS" -echo "softhsm-mock-identity-system-2-0-0 secret copied to $ESIGNET_NS." +$COPY_UTIL secret softhsm-mock-identity-system-go "$SOFTHSM_NS" "$ESIGNET_NS" +echo "softhsm-mock-identity-system-go secret copied to $ESIGNET_NS." # Read internal host from postgres-config (already present from esignet-preinstall.sh) DB_HOST=$(kubectl -n "$ESIGNET_NS" get configmap postgres-config \ @@ -50,11 +50,11 @@ kubectl -n "$ESIGNET_NS" create configmap mockid-postgres-config \ echo "mockid-postgres-config created/updated in $ESIGNET_NS (host=$DB_HOST db=$MOCKID_DB_NAME user=$MOCKID_DB_USER)." # Verify SoftHSM mock identity configmap exists in esignet namespace -if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-2-0-0-share &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-go-share &>/dev/null; then echo "SoftHSM mock identity system configmap found." else - echo "ERROR: softhsm-mock-identity-system-2-0-0-share configmap not found in $ESIGNET_NS namespace." - echo "Deploy softhsm-mock-identity-system-2-0-0 before running mock identity system install." + echo "ERROR: softhsm-mock-identity-system-go-share configmap not found in $ESIGNET_NS namespace." + echo "Deploy softhsm-mock-identity-system-go before running mock identity system install." exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh index b7344e008..1847d2e5a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh @@ -6,5 +6,5 @@ # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1-2-0-0" +export ESIGNET_NS="esignet-go-mosipid1" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh index 310443206..069f92439 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh @@ -6,5 +6,5 @@ # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid2-2-0-0" +export ESIGNET_NS="esignet-go-mosipid2" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh index 760dab3af..45b51adcd 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" CLIENT_KEY_TMPFILE="" JWE_KEY_TMPFILE="" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh index 74e3a40c2..7cb2fcbb6 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh @@ -6,5 +6,5 @@ # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-sunbird-2-0-0" +export ESIGNET_NS="esignet-go-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh index 8617e09d6..ec760852b 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh @@ -7,7 +7,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid1-2-0-0" +ESIGNET_NS="esignet-go-mosipid1" echo "================================================" echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh index e3446b839..dbc497eac 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh @@ -7,7 +7,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid2-2-0-0" +ESIGNET_NS="esignet-go-mosipid2" echo "================================================" echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh index f64148d2f..fc3f5122a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh @@ -11,10 +11,10 @@ echo "eSignet 1.7.1 - Mock Relying Party UI Pre-install" echo "================================================" # Ensure esignet namespace exists -kubectl create namespace esignet-mock-2-0-0 --dry-run=client -o yaml | kubectl apply -f - +kubectl create namespace esignet-go-mock --dry-run=client -o yaml | kubectl apply -f - # Verify mock relying party service is available -if kubectl -n esignet-mock-2-0-0 get svc mock-relying-party-service-2-0-0 &>/dev/null; then +if kubectl -n esignet-go-mock get svc mock-relying-party-service-2-0-0 &>/dev/null; then echo "Mock relying party service found." else echo "WARNING: Mock relying party service not found. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh index 382b882b7..b2e99f6c4 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh @@ -7,7 +7,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-sunbird-2-0-0" +ESIGNET_NS="esignet-go-sunbird" echo "================================================" echo "eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh index 61e29f4c0..fb19d5533 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1-2-0-0" +export ESIGNET_NS="esignet-go-mosipid1" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh index cbb320f2d..9ccb94471 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid2-2-0-0" +export ESIGNET_NS="esignet-go-mosipid2" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh index ccce694cf..3edf203d4 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" echo "================================================" echo "eSignet 1.7.1 - OIDC UI Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh index b1fc1930b..9ab201731 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-sunbird-2-0-0" +export ESIGNET_NS="esignet-go-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh index 4168e280a..0a94341e4 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh @@ -6,7 +6,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid1-2-0-0" +ESIGNET_NS="esignet-go-mosipid1" echo "================================================" echo "eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install" @@ -19,14 +19,14 @@ metadata: name: pms-partner-mosipid1-gateway namespace: ${ESIGNET_NS} labels: - app.kubernetes.io/instance: pms-partner-mosipid1-2-0-0 + app.kubernetes.io/instance: pms-partner-go-mosipid1 app.kubernetes.io/name: pms-partner spec: selector: istio: ingressgateway servers: - hosts: - - pms-mosipid1-2-0-0.${domain_name} + - pms-go-mosipid1.${domain_name} port: name: https number: 443 @@ -35,7 +35,7 @@ spec: credentialName: pms-partner-mosipid1-tls mode: SIMPLE - hosts: - - pms-mosipid1-2-0-0.${domain_name} + - pms-go-mosipid1.${domain_name} port: name: http number: 80 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh index 6da443a35..6ac2fe3fc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh @@ -6,7 +6,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid2-2-0-0" +ESIGNET_NS="esignet-go-mosipid2" echo "================================================" echo "eSignet 1.7.1 - PMS Partner MOSIPID2 Pre-install" @@ -19,14 +19,14 @@ metadata: name: pms-partner-mosipid2-gateway namespace: ${ESIGNET_NS} labels: - app.kubernetes.io/instance: pms-partner-mosipid2-2-0-0 + app.kubernetes.io/instance: pms-partner-go-mosipid2 app.kubernetes.io/name: pms-partner spec: selector: istio: ingressgateway servers: - hosts: - - pms-mosipid2-2-0-0.${domain_name} + - pms-go-mosipid2.${domain_name} port: name: https number: 443 @@ -35,7 +35,7 @@ spec: credentialName: pms-partner-mosipid2-tls mode: SIMPLE - hosts: - - pms-mosipid2-2-0-0.${domain_name} + - pms-go-mosipid2.${domain_name} port: name: http number: 80 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh index 8252fda13..e1221704f 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh @@ -12,7 +12,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" INSTALLATION_DOMAIN="${INSTALLATION_DOMAIN:-sandbox.xyz.net}" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh index 92b1d72e0..055fc510e 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" REDIS_NS="redis" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh index 7b3ae0c44..c9d0ccc04 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base softhsm setup. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1-2-0-0" +export ESIGNET_NS="esignet-go-mosipid1" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh index 707ed2283..9d16c2ec8 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base softhsm setup. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid2-2-0-0" +export ESIGNET_NS="esignet-go-mosipid2" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh index 36f098df9..e907bcdce 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh @@ -13,7 +13,7 @@ set -euo pipefail SOFTHSM_NS="${SOFTHSM_NS:-softhsm-2-0-0}" -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" @@ -22,7 +22,7 @@ echo "================================================" # --- Step 1: Wait for SoftHSM pod to be ready --- echo "Waiting for SoftHSM pod to be ready..." -kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm-2-0-0 --timeout=480s || \ +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm-go --timeout=480s || \ { echo "ERROR: SoftHSM pod not ready after timeout" >&2; exit 1; } # --- Step 2: Copy esignet-softhsm-share configmap to esignet namespace --- @@ -31,8 +31,8 @@ $COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/nu echo "WARNING: esignet-softhsm-share configmap not found in $SOFTHSM_NS" # --- Step 3: Copy esignet-softhsm secret to esignet namespace --- -echo "Copying esignet-softhsm-2-0-0 secret to $ESIGNET_NS namespace" -$COPY_UTIL secret esignet-softhsm-2-0-0 "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ - echo "WARNING: esignet-softhsm-2-0-0 secret not found in $SOFTHSM_NS" +echo "Copying esignet-softhsm-go secret to $ESIGNET_NS namespace" +$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ + echo "WARNING: esignet-softhsm-go secret not found in $SOFTHSM_NS" echo "SoftHSM eSignet post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh index 388038fed..84f6961e0 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" echo "================================================" echo "eSignet 1.7.1 - SoftHSM eSignet Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh index d3c83e3f2..1e9584f8a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base softhsm setup. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-sunbird-2-0-0" +export ESIGNET_NS="esignet-go-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh index 328b44d70..f0faf76a2 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh @@ -2,14 +2,14 @@ # ============================================================================= # eSignet 1.7.1 - SoftHSM Mock Identity System Post-install # ============================================================================= -# Copies chart-generated softhsm-mock-identity-system-2-0-0-share configmap +# Copies chart-generated softhsm-mock-identity-system-go-share configmap # (PKCS11 slot/token config) from softhsm namespace to esignet-mock namespace. # The security PIN is handled separately via secret copy in preinstall. # ============================================================================= set -euo pipefail SOFTHSM_NS="${SOFTHSM_NS:-softhsm-2-0-0}" -ESIGNET_NS="${ESIGNET_NS:-esignet-mock-2-0-0}" +ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" @@ -17,11 +17,11 @@ echo "eSignet 1.7.1 - SoftHSM Mock Identity System Post-install" echo "================================================" # Wait for SoftHSM mock identity pod to be ready -kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=softhsm-mock-identity-system-2-0-0 --timeout=480s || \ +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=softhsm-mock-identity-system-go --timeout=480s || \ { echo "ERROR: SoftHSM mock identity system pod not ready after timeout" >&2; exit 1; } # Copy chart-generated PKCS11 configmap to esignet-mock namespace -echo "Copying softhsm-mock-identity-system-2-0-0-share configmap to $ESIGNET_NS" -$COPY_UTIL configmap softhsm-mock-identity-system-2-0-0-share "$SOFTHSM_NS" "$ESIGNET_NS" +echo "Copying softhsm-mock-identity-system-go-share configmap to $ESIGNET_NS" +$COPY_UTIL configmap softhsm-mock-identity-system-go-share "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM mock identity system post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh index 806aaa2ee..f69b2cadc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh @@ -63,17 +63,17 @@ echo "================================================" echo "eSignet 1.7.1 - Trigger Testrig CronJobs" echo "================================================" -echo "=== eSignet API Testrig (esignet-mock-2-0-0 ns) ===" -trigger_all_in_ns esignet-mock-2-0-0 || OVERALL_SUCCESS=false +echo "=== eSignet API Testrig (esignet-go-mock ns) ===" +trigger_all_in_ns esignet-go-mock || OVERALL_SUCCESS=false -echo "=== eSignet-MOSIPID1 API Testrig (esignet-mosipid1-2-0-0 ns) ===" -trigger_all_in_ns esignet-mosipid1-2-0-0 || OVERALL_SUCCESS=false +echo "=== eSignet-MOSIPID1 API Testrig (esignet-go-mosipid1 ns) ===" +trigger_all_in_ns esignet-go-mosipid1 || OVERALL_SUCCESS=false -echo "=== eSignet-MOSIPID2 API Testrig (esignet-mosipid2-2-0-0 ns) ===" -trigger_all_in_ns esignet-mosipid2-2-0-0 || OVERALL_SUCCESS=false +echo "=== eSignet-MOSIPID2 API Testrig (esignet-go-mosipid2 ns) ===" +trigger_all_in_ns esignet-go-mosipid2 || OVERALL_SUCCESS=false -echo "=== eSignet-Sunbird API Testrig (esignet-sunbird-2-0-0 ns) ===" -trigger_all_in_ns esignet-sunbird-2-0-0 || OVERALL_SUCCESS=false +echo "=== eSignet-Sunbird API Testrig (esignet-go-sunbird ns) ===" +trigger_all_in_ns esignet-go-sunbird || OVERALL_SUCCESS=false echo "=== Signup API Testrig (signup-2-0-0 ns, if deployed) ===" trigger_all_in_ns signup-2-0-0 || true diff --git a/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml index 5f1faa2fb..45598cc92 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml @@ -96,21 +96,21 @@ envVariables: - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_SOFTHSM_ESIGNET_SECURITY_PIN valueFrom: secretKeyRef: - name: esignet-softhsm-2-0-0 + name: esignet-softhsm-go key: security-pin enabled: true - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ESIGNET_CAPTCHA_SECRET_KEY valueFrom: secretKeyRef: - name: esignet-captcha-2-0-0 + name: esignet-captcha-go key: esignet-captcha-secret-key enabled: true - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ESIGNET_CAPTCHA_SITE_KEY valueFrom: secretKeyRef: - name: esignet-captcha-2-0-0 + name: esignet-captcha-go key: esignet-captcha-site-key enabled: true diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 22491ea1d..21dbe3d58 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -54,7 +54,7 @@ extraEnvVars: - name: SOFTHSM_ESIGNET_SECURITY_PIN valueFrom: secretKeyRef: - name: esignet-softhsm-mosipid1-2-0-0 + name: esignet-softhsm-go-mosipid1 key: security-pin - name: MOSIP_IDA_CLIENT_SECRET valueFrom: @@ -68,7 +68,7 @@ extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" valueFrom: secretKeyRef: - name: esignet-captcha-mosipid1-2-0-0 + name: esignet-captcha-go-mosipid1 key: esignet-captcha-site-key # --------------------------------------------------------------------------- diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index de7a6de77..68d3d08b2 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -52,7 +52,7 @@ extraEnvVars: - name: SOFTHSM_ESIGNET_SECURITY_PIN valueFrom: secretKeyRef: - name: esignet-softhsm-mosipid2-2-0-0 + name: esignet-softhsm-go-mosipid2 key: security-pin - name: MOSIP_IDA_CLIENT_SECRET valueFrom: @@ -66,7 +66,7 @@ extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" valueFrom: secretKeyRef: - name: esignet-captcha-mosipid2-2-0-0 + name: esignet-captcha-go-mosipid2 key: esignet-captcha-site-key # --------------------------------------------------------------------------- diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index a3f4785b9..bc12b19e7 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -19,7 +19,7 @@ extraEnvVars: - name: MOSIP_ESIGNET_CAPTCHA_SITE_KEY valueFrom: secretKeyRef: - name: esignet-captcha-2-0-0 + name: esignet-captcha-go key: esignet-captcha-site-key - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME value: esignet @@ -66,7 +66,7 @@ extraEnvVars: - name: SOFTHSM_ESIGNET_SECURITY_PIN valueFrom: secretKeyRef: - name: esignet-softhsm-2-0-0 + name: esignet-softhsm-go key: security-pin - name: MOSIP_IDA_CLIENT_SECRET valueFrom: @@ -96,7 +96,7 @@ extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" valueFrom: secretKeyRef: - name: esignet-captcha-2-0-0 + name: esignet-captcha-go key: esignet-captcha-site-key - name: "MOSIP_ESIGNET_CAPTCHA_REQUIRED" value: "" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index 811b508d6..cf9545001 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -54,7 +54,7 @@ extraEnvVars: - name: SOFTHSM_ESIGNET_SECURITY_PIN valueFrom: secretKeyRef: - name: esignet-softhsm-sunbird-2-0-0 + name: esignet-softhsm-go-sunbird key: security-pin - name: MOSIP_IDA_CLIENT_SECRET valueFrom: @@ -66,7 +66,7 @@ extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" valueFrom: secretKeyRef: - name: esignet-captcha-sunbird-2-0-0 + name: esignet-captcha-go-sunbird key: esignet-captcha-site-key - name: "MOSIP_ESIGNET_CAPTCHA_REQUIRED" value: "" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml index e6fc7ff13..1cbf9dc1e 100755 --- a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml @@ -27,7 +27,7 @@ extraEnvVars: - name: SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN valueFrom: secretKeyRef: - name: softhsm-mock-identity-system-2-0-0 + name: softhsm-mock-identity-system-go key: security-pin - name: hsm_local_dir_name value: hsm-client From a17de5bfc834d62aa86b71dc877eb2117d7b69ab Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 24 Jul 2026 17:59:49 +0530 Subject: [PATCH 015/127] fix: #302 Complete the -go rename across the rest of the esignet-standalone-2.0.0 profile: signup-captcha, and every remaining -2-0-0-suffixed namespace, release name, hostname, and Postgres database/user name (signup, kernel services, mock-relying-party base instances, mock-smtp, config-server, mock-identity-system, oidc-ui, softhsm, apitestrig releases, MISP/mock-RP onboarders, and the isolated postgres-init database entries in the shared external-dsf.yaml). Original esignet-standalone profile and its unsuffixed database entries are untouched. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 58 +++--- .../esignet-standalone-2.0.0/signup-dsf.yaml | 50 +++--- .../testrigs-dsf.yaml | 20 +-- .../dsf/esignet-standalone/external-dsf.yaml | 166 +++++++++--------- .../apitestrig-signup-setup.sh | 2 +- .../config-server-esignet-postinstall.sh | 2 +- .../config-server-esignet-setup.sh | 4 +- .../esignet-misp-onboarder-postinstall.sh | 16 +- .../esignet-mock-rp-onboarder-postinstall.sh | 16 +- .../esignet-mosipid1-preinstall.sh | 2 +- .../esignet-mosipid2-preinstall.sh | 2 +- .../esignet-preinstall.sh | 2 +- .../esignet-sunbird-preinstall.sh | 2 +- .../kernel-preinstall.sh | 2 +- .../mock-identity-system-preinstall.sh | 6 +- ...ck-relying-party-ui-mosipid1-preinstall.sh | 2 +- ...ck-relying-party-ui-mosipid2-preinstall.sh | 2 +- .../mock-relying-party-ui-preinstall.sh | 2 +- ...ock-relying-party-ui-sunbird-preinstall.sh | 2 +- .../notifier-postinstall.sh | 6 +- .../signup-init-db.sh | 2 +- .../signup-keycloak-init-postinstall.sh | 2 +- .../signup-keycloak-init-preinstall.sh | 2 +- .../signup-service-preinstall.sh | 30 ++-- .../softhsm-esignet-postinstall.sh | 2 +- ...ofthsm-mock-identity-system-postinstall.sh | 2 +- ...softhsm-mock-identity-system-preinstall.sh | 4 +- .../trigger-test-jobs-esignet.sh | 8 +- .../uitestrig-signup-setup.sh | 2 +- 29 files changed, 209 insertions(+), 209 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 0d45c0c3b..14a0be2d1 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -30,7 +30,7 @@ helmRepos: namespaces: esignet-go-mock: protected: false - softhsm-2-0-0: + softhsm-go: protected: false esignet-go-mosipid1: protected: false @@ -89,7 +89,7 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh" - esignet-config-server-2-0-0: + esignet-config-server-go: namespace: esignet-go-mock enabled: false version: 12.0.1 @@ -122,8 +122,8 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-2-0-0.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-2-0-0.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" @@ -254,7 +254,7 @@ apps: # --------------------------------------------------------------------------- # OIDC UI v1.7.1 # --------------------------------------------------------------------------- - oidc-ui-2-0-0: + oidc-ui-go: namespace: esignet-go-mock enabled: true version: 0.0.1-develop @@ -262,7 +262,7 @@ apps: set: image.repository: "mosipqa/oidc-ui" image.tag: "develop" - istio.hosts[0]: "esignet-2-0-0.${domain_name}" + istio.hosts[0]: "esignet-go.${domain_name}" oidc_ui.oidc_service_host: "esignet-go-mock.esignet-go-mock" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mock.esignet-go-mock" @@ -327,7 +327,7 @@ apps: # --------------------------------------------------------------------------- # Enable for testing with mock identity data. softhsm-mock-identity-system-go: - namespace: softhsm-2-0-0 + namespace: softhsm-go enabled: true version: 12.0.1 chart: mosip/softhsm @@ -341,7 +341,7 @@ apps: preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh" postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh" - mock-identity-system-2-0-0: + mock-identity-system-go: namespace: esignet-go-mock enabled: true version: 0.0.1-develop @@ -352,8 +352,8 @@ apps: image.tag: "develop" enable_insecure: "false" extraEnvVarsCM[0]: "softhsm-mock-identity-system-go-share" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-2-0-0.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-2-0-0.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" @@ -371,14 +371,14 @@ apps: # --------------------------------------------------------------------------- # Mock Relying Party (Optional) # --------------------------------------------------------------------------- - mock-relying-party-service-2-0-0: + mock-relying-party-service-go: namespace: esignet-go-mock enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-2-0-0.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -431,20 +431,20 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh" - mock-relying-party-ui-2-0-0: + mock-relying-party-ui-go: namespace: esignet-go-mock enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-2-0-0.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-2-0-0.esignet-go-mock" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-2-0-0.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-2-0-0.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-2-0-0.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-2-0-0.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-2-0-0.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-2-0-0.${domain_name}" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go.esignet-go-mock" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go.${domain_name}/plugins/sign-in-button-plugin.js" + istio.hosts[0]: "healthservices-go.${domain_name}" wait: true timeout: 480 priority: -9 @@ -522,7 +522,7 @@ apps: istio.gateways[0]: "pms-partner-mosipid1-gateway" istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid1.${domain_name}" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" + extraEnvVarsCM[1]: "esignet-config-server-go-share" priority: -9 timeout: 1200 hooks: @@ -539,7 +539,7 @@ apps: istio.gateways[0]: "pms-partner-mosipid1-gateway" istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid1.${domain_name}" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" + extraEnvVarsCM[1]: "esignet-config-server-go-share" priority: -9 timeout: 1200 @@ -554,7 +554,7 @@ apps: istio.gateways[0]: "pms-partner-mosipid2-gateway" istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid2.${domain_name}" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" + extraEnvVarsCM[1]: "esignet-config-server-go-share" priority: -9 timeout: 1200 hooks: @@ -570,7 +570,7 @@ apps: # image.tag: "1.2.2.2" istio.gateways[0]: "pms-partner-mosipid2-gateway" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-2-0-0-share" + extraEnvVarsCM[1]: "esignet-config-server-go-share" istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid2.${domain_name}" priority: -9 timeout: 1200 @@ -586,7 +586,7 @@ apps: # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. # After completion, restarts the esignet deployment to pick up the new MISP license key. - esignet-misp-onboarder-2-0-0: + esignet-misp-onboarder-go: namespace: esignet-go-mock enabled: false version: 0.0.1-develop @@ -608,7 +608,7 @@ apps: extraEnvVarsSecret[1]: "keycloak-client-secrets" domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" domainConfig.mosip-api-host: "api.${domain_name}" - domainConfig.mosip-esignet-host: "esignet-2-0-0.${domain_name}" + domainConfig.mosip-esignet-host: "esignet-go.${domain_name}" domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" domainConfig.mosip-resident-host: "resident.${domain_name}" domainConfig.installation-domain: "${domain_name}" @@ -625,7 +625,7 @@ apps: # Mock RP OIDC Partner Onboarder # Onboards the mock relying party as an OIDC client. # Enable for plugin 1 (mock) or plugin 3 (sunbird-rc). Set mosipid: "true" for mosip-identity-plugin. - esignet-mock-rp-onboarder-2-0-0: + esignet-mock-rp-onboarder-go: namespace: esignet-go-mock enabled: true version: 0.0.1-develop @@ -647,7 +647,7 @@ apps: extraEnvVarsCM[1]: "keycloak-host" domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" domainConfig.mosip-api-host: "api.${domain_name}" - domainConfig.mosip-esignet-host: "esignet-2-0-0.${domain_name}" + domainConfig.mosip-esignet-host: "esignet-go.${domain_name}" domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" domainConfig.mosip-resident-host: "resident.${domain_name}" domainConfig.installation-domain: "${domain_name}" diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml index 3bcfb9196..1139c2973 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml @@ -35,11 +35,11 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm namespaces: - signup-2-0-0: + signup-go: protected: false - kernel-2-0-0: + kernel-go: protected: false - mock-smtp-2-0-0: + mock-smtp-go: protected: false apps: @@ -48,8 +48,8 @@ apps: # --------------------------------------------------------------------------- # Creates mosip-signup-client with required roles in Keycloak. # Propagates mosip_signup_client_secret between keycloak and signup namespaces. - signup-keycloak-init-2-0-0: - namespace: signup-2-0-0 + signup-keycloak-init-go: + namespace: signup-go enabled: false version: 12.0.2 chart: mosip/keycloak-init @@ -73,8 +73,8 @@ apps: # Required for audit logging (auditmanager), OTP generation (otpmanager), # auth token validation (authmanager), and email/SMS dispatch (notifier). # kernel-preinstall.sh creates kernel namespace and domain-config configmap. - authmanager-2-0-0: - namespace: kernel-2-0-0 + authmanager-go: + namespace: kernel-go enabled: false version: 12.0.1 chart: mosip/authmanager @@ -87,8 +87,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - auditmanager-2-0-0: - namespace: kernel-2-0-0 + auditmanager-go: + namespace: kernel-go enabled: false version: 12.0.1 chart: mosip/auditmanager @@ -101,8 +101,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - otpmanager-2-0-0: - namespace: kernel-2-0-0 + otpmanager-go: + namespace: kernel-go enabled: false version: 12.0.1 chart: mosip/otpmanager @@ -113,8 +113,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - notifier-2-0-0: - namespace: kernel-2-0-0 + notifier-go: + namespace: kernel-go enabled: false version: 12.0.1 chart: mosip/notifier @@ -128,8 +128,8 @@ apps: # --------------------------------------------------------------------------- # Mock SMTP (Optional — dev/test email and SMS) # --------------------------------------------------------------------------- - mock-smtp-2-0-0: - namespace: mock-smtp-2-0-0 + mock-smtp-go: + namespace: mock-smtp-go enabled: false version: 1.0.0 chart: mosip/mock-smtp @@ -145,8 +145,8 @@ apps: # signup-service-preinstall.sh copies redis secrets, creates keycloak-host # configmap, signup-captcha and signup-keystore secrets, and msg-gateway # configmap/secret pointing to mock-smtp. - signup-2-0-0: - namespace: signup-2-0-0 + signup-go: + namespace: signup-go enabled: false version: 1.2.2 chart: mosip/signup @@ -155,8 +155,8 @@ apps: image.tag: "1.2.2" enable_insecure: "false" plugin_name_env: "esignet-mock-plugin.jar" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-2-0-0.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-2-0-0.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" wait: true timeout: 600 @@ -168,18 +168,18 @@ apps: # --------------------------------------------------------------------------- # Signup UI # --------------------------------------------------------------------------- - signup-ui-2-0-0: - namespace: signup-2-0-0 + signup-ui-go: + namespace: signup-go enabled: false version: 1.2.2 chart: mosip/signup-ui set: image.repository: "mosipid/signup-ui" image.tag: "1.2.2" - istio.hosts[0]: "signup-2-0-0.${domain_name}" - signup_ui.signup_service_host: "signup-2-0-0.signup-2-0-0" - signup_ui.configmaps.signup-ui.REACT_APP_API_BASE_URL: "http://signup-2-0-0.signup-2-0-0/v1/signup" - signup_ui.configmaps.signup-ui.REACT_APP_SBI_DOMAIN_URI: "http://signup-2-0-0.signup-2-0-0" + istio.hosts[0]: "signup-go.${domain_name}" + signup_ui.signup_service_host: "signup-go.signup-go" + signup_ui.configmaps.signup-ui.REACT_APP_API_BASE_URL: "http://signup-go.signup-go/v1/signup" + signup_ui.configmaps.signup-ui.REACT_APP_SBI_DOMAIN_URI: "http://signup-go.signup-go" wait: true timeout: 600 priority: -3 diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index 889356da1..b5d29dc53 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -23,16 +23,16 @@ namespaces: protected: false esignet-go-sunbird: protected: false - signup-2-0-0: + signup-go: protected: false - signup-uitestrig-2-0-0: + signup-uitestrig-go: protected: false apps: # --------------------------------------------------------------------------- # eSignet API Testrig — main esignet namespace # --------------------------------------------------------------------------- - esignet-apitestrig-2-0-0: + esignet-apitestrig-go: namespace: esignet-go-mock enabled: true version: 0.0.1-develop @@ -66,7 +66,7 @@ apps: apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-2-0-0.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" @@ -218,8 +218,8 @@ apps: # Signup API Test Rig — disabled by default # Enable only if signup stack (signup-dsf) is deployed. # --------------------------------------------------------------------------- - esignet-signup-apitestrig-2-0-0: - namespace: signup-2-0-0 + esignet-signup-apitestrig-go: + namespace: signup-go enabled: false version: 0.0.1-develop chart: mosip/apitestrig @@ -238,7 +238,7 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "signup-2-0-0" + apitestrig.configmaps.apitestrig.NS: "signup-go" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" @@ -250,8 +250,8 @@ apps: # Signup UI Test Rig — disabled by default # Enable only if signup stack (signup-dsf) is deployed. # --------------------------------------------------------------------------- - signup-uitestrig-2-0-0: - namespace: signup-uitestrig-2-0-0 + signup-uitestrig-go: + namespace: signup-uitestrig-go enabled: false version: 0.0.1-develop chart: mosip/uitestrig @@ -269,7 +269,7 @@ apps: uitestrig.configmaps.uitestrig.reportExpirationInDays: "3" uitestrig.configmaps.uitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" uitestrig.configmaps.uitestrig.eSignetDeployed: "yes" - uitestrig.configmaps.uitestrig.NS: "signup-uitestrig-2-0-0" + uitestrig.configmaps.uitestrig.NS: "signup-uitestrig-go" uitestrig.variables.push_reports_to_s3: "yes" priority: -1 hooks: diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index 4c5ef97b4..c25538342 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -186,71 +186,71 @@ apps: # --------------------------------------------------------------------------- # esignet-standalone-2.0.0 profile — isolated databases (own data, shared postgres) # --------------------------------------------------------------------------- - databases.mosip_esignet_2_0_0.enabled: "true" - databases.mosip_esignet_2_0_0.scriptsDir: "mosip_esignet" - databases.mosip_esignet_2_0_0.dbName: "mosip_esignet_2_0_0" - databases.mosip_esignet_2_0_0.dbUser: "esignetuser_2_0_0" - databases.mosip_esignet_2_0_0.branch: "develop" - databases.mosip_esignet_2_0_0.host: "postgres.${domain_name}" - databases.mosip_esignet_2_0_0.port: ${esignet_db_port} - databases.mosip_esignet_2_0_0.dml: 1 - databases.mosip_esignet_2_0_0.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_2_0_0.defaultDb: "postgres" - databases.mosip_esignet_2_0_0.su.user: "postgres" - databases.mosip_esignet_2_0_0.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_2_0_0.su.secret.key: "postgres-password" - databases.mosip_esignet_mosipid1_2_0_0.enabled: "true" - databases.mosip_esignet_mosipid1_2_0_0.scriptsDir: "mosip_esignet" - databases.mosip_esignet_mosipid1_2_0_0.dbName: "mosip_esignet_mosipid1_2_0_0" - databases.mosip_esignet_mosipid1_2_0_0.dbUser: "esignetuser_mosipid1_2_0_0" - databases.mosip_esignet_mosipid1_2_0_0.branch: "develop" - databases.mosip_esignet_mosipid1_2_0_0.host: "postgres.${domain_name}" - databases.mosip_esignet_mosipid1_2_0_0.port: ${esignet_db_port} - databases.mosip_esignet_mosipid1_2_0_0.dml: 1 - databases.mosip_esignet_mosipid1_2_0_0.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid1_2_0_0.defaultDb: "postgres" - databases.mosip_esignet_mosipid1_2_0_0.su.user: "postgres" - databases.mosip_esignet_mosipid1_2_0_0.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid1_2_0_0.su.secret.key: "postgres-password" - databases.mosip_esignet_mosipid2_2_0_0.enabled: "true" - databases.mosip_esignet_mosipid2_2_0_0.scriptsDir: "mosip_esignet" - databases.mosip_esignet_mosipid2_2_0_0.dbName: "mosip_esignet_mosipid2_2_0_0" - databases.mosip_esignet_mosipid2_2_0_0.dbUser: "esignetuser_mosipid2_2_0_0" - databases.mosip_esignet_mosipid2_2_0_0.branch: "develop" - databases.mosip_esignet_mosipid2_2_0_0.host: "postgres.${domain_name}" - databases.mosip_esignet_mosipid2_2_0_0.port: ${esignet_db_port} - databases.mosip_esignet_mosipid2_2_0_0.dml: 1 - databases.mosip_esignet_mosipid2_2_0_0.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid2_2_0_0.defaultDb: "postgres" - databases.mosip_esignet_mosipid2_2_0_0.su.user: "postgres" - databases.mosip_esignet_mosipid2_2_0_0.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid2_2_0_0.su.secret.key: "postgres-password" - databases.mosip_esignet_sunbird_2_0_0.enabled: "true" - databases.mosip_esignet_sunbird_2_0_0.scriptsDir: "mosip_esignet" - databases.mosip_esignet_sunbird_2_0_0.dbName: "mosip_esignet_sunbird_2_0_0" - databases.mosip_esignet_sunbird_2_0_0.dbUser: "esignetuser_sunbird_2_0_0" - databases.mosip_esignet_sunbird_2_0_0.branch: "develop" - databases.mosip_esignet_sunbird_2_0_0.host: "postgres.${domain_name}" - databases.mosip_esignet_sunbird_2_0_0.port: ${esignet_db_port} - databases.mosip_esignet_sunbird_2_0_0.dml: 1 - databases.mosip_esignet_sunbird_2_0_0.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_sunbird_2_0_0.defaultDb: "postgres" - databases.mosip_esignet_sunbird_2_0_0.su.user: "postgres" - databases.mosip_esignet_sunbird_2_0_0.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_sunbird_2_0_0.su.secret.key: "postgres-password" - databases.mosip_mockidentitysystem_2_0_0.enabled: "true" - databases.mosip_mockidentitysystem_2_0_0.scriptsDir: "mosip_mockidentitysystem" - databases.mosip_mockidentitysystem_2_0_0.dbName: "mosip_mockidentitysystem_2_0_0" - databases.mosip_mockidentitysystem_2_0_0.dbUser: "mockidentityuser_2_0_0" - databases.mosip_mockidentitysystem_2_0_0.branch: "develop" - databases.mosip_mockidentitysystem_2_0_0.host: "postgres.${domain_name}" - databases.mosip_mockidentitysystem_2_0_0.repoUrl: "https://github.com/mosip/esignet-mock-services.git" - databases.mosip_mockidentitysystem_2_0_0.port: ${esignet_db_port} - databases.mosip_mockidentitysystem_2_0_0.dml: 1 - databases.mosip_mockidentitysystem_2_0_0.defaultDb: "postgres" - databases.mosip_mockidentitysystem_2_0_0.su.user: "postgres" - databases.mosip_mockidentitysystem_2_0_0.su.secret.name: "postgres-postgresql" - databases.mosip_mockidentitysystem_2_0_0.su.secret.key: "postgres-password" + databases.mosip_esignet_go.enabled: "true" + databases.mosip_esignet_go.scriptsDir: "mosip_esignet" + databases.mosip_esignet_go.dbName: "mosip_esignet_go" + databases.mosip_esignet_go.dbUser: "esignetuser_go" + databases.mosip_esignet_go.branch: "develop" + databases.mosip_esignet_go.host: "postgres.${domain_name}" + databases.mosip_esignet_go.port: ${esignet_db_port} + databases.mosip_esignet_go.dml: 1 + databases.mosip_esignet_go.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_go.defaultDb: "postgres" + databases.mosip_esignet_go.su.user: "postgres" + databases.mosip_esignet_go.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_go.su.secret.key: "postgres-password" + databases.mosip_esignet_go_mosipid1.enabled: "true" + databases.mosip_esignet_go_mosipid1.scriptsDir: "mosip_esignet" + databases.mosip_esignet_go_mosipid1.dbName: "mosip_esignet_go_mosipid1" + databases.mosip_esignet_go_mosipid1.dbUser: "esignetuser_go_mosipid1" + databases.mosip_esignet_go_mosipid1.branch: "develop" + databases.mosip_esignet_go_mosipid1.host: "postgres.${domain_name}" + databases.mosip_esignet_go_mosipid1.port: ${esignet_db_port} + databases.mosip_esignet_go_mosipid1.dml: 1 + databases.mosip_esignet_go_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_go_mosipid1.defaultDb: "postgres" + databases.mosip_esignet_go_mosipid1.su.user: "postgres" + databases.mosip_esignet_go_mosipid1.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_go_mosipid1.su.secret.key: "postgres-password" + databases.mosip_esignet_go_mosipid2.enabled: "true" + databases.mosip_esignet_go_mosipid2.scriptsDir: "mosip_esignet" + databases.mosip_esignet_go_mosipid2.dbName: "mosip_esignet_go_mosipid2" + databases.mosip_esignet_go_mosipid2.dbUser: "esignetuser_go_mosipid2" + databases.mosip_esignet_go_mosipid2.branch: "develop" + databases.mosip_esignet_go_mosipid2.host: "postgres.${domain_name}" + databases.mosip_esignet_go_mosipid2.port: ${esignet_db_port} + databases.mosip_esignet_go_mosipid2.dml: 1 + databases.mosip_esignet_go_mosipid2.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_go_mosipid2.defaultDb: "postgres" + databases.mosip_esignet_go_mosipid2.su.user: "postgres" + databases.mosip_esignet_go_mosipid2.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_go_mosipid2.su.secret.key: "postgres-password" + databases.mosip_esignet_go_sunbird.enabled: "true" + databases.mosip_esignet_go_sunbird.scriptsDir: "mosip_esignet" + databases.mosip_esignet_go_sunbird.dbName: "mosip_esignet_go_sunbird" + databases.mosip_esignet_go_sunbird.dbUser: "esignetuser_go_sunbird" + databases.mosip_esignet_go_sunbird.branch: "develop" + databases.mosip_esignet_go_sunbird.host: "postgres.${domain_name}" + databases.mosip_esignet_go_sunbird.port: ${esignet_db_port} + databases.mosip_esignet_go_sunbird.dml: 1 + databases.mosip_esignet_go_sunbird.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_go_sunbird.defaultDb: "postgres" + databases.mosip_esignet_go_sunbird.su.user: "postgres" + databases.mosip_esignet_go_sunbird.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_go_sunbird.su.secret.key: "postgres-password" + databases.mosip_mockidentitysystem_go.enabled: "true" + databases.mosip_mockidentitysystem_go.scriptsDir: "mosip_mockidentitysystem" + databases.mosip_mockidentitysystem_go.dbName: "mosip_mockidentitysystem_go" + databases.mosip_mockidentitysystem_go.dbUser: "mockidentityuser_go" + databases.mosip_mockidentitysystem_go.branch: "develop" + databases.mosip_mockidentitysystem_go.host: "postgres.${domain_name}" + databases.mosip_mockidentitysystem_go.repoUrl: "https://github.com/mosip/esignet-mock-services.git" + databases.mosip_mockidentitysystem_go.port: ${esignet_db_port} + databases.mosip_mockidentitysystem_go.dml: 1 + databases.mosip_mockidentitysystem_go.defaultDb: "postgres" + databases.mosip_mockidentitysystem_go.su.user: "postgres" + databases.mosip_mockidentitysystem_go.su.secret.name: "postgres-postgresql" + databases.mosip_mockidentitysystem_go.su.secret.key: "postgres-password" wait: true timeout: 300 priority: -16 @@ -310,24 +310,24 @@ apps: # --------------------------------------------------------------------------- # esignet-standalone-2.0.0 profile — isolated signup/kernel databases # --------------------------------------------------------------------------- - databases.mosip_audit_2_0_0.enabled: "true" - databases.mosip_audit_2_0_0.branch: "v1.2.0.1" - databases.mosip_audit_2_0_0.repoUrl: "https://github.com/mosip/audit-manager.git" - databases.mosip_audit_2_0_0.host: "postgres.${domain_name}" - databases.mosip_audit_2_0_0.port: ${esignet_db_port} - databases.mosip_audit_2_0_0.dml: 0 - databases.mosip_kernel_2_0_0.enabled: "true" - databases.mosip_kernel_2_0_0.branch: "v1.2.0.1" - databases.mosip_kernel_2_0_0.repoUrl: "https://github.com/mosip/commons.git" - databases.mosip_kernel_2_0_0.host: "postgres.${domain_name}" - databases.mosip_kernel_2_0_0.port: ${esignet_db_port} - databases.mosip_kernel_2_0_0.dml: 0 - databases.mosip_otp_2_0_0.enabled: "true" - databases.mosip_otp_2_0_0.branch: "v1.2.0.1" - databases.mosip_otp_2_0_0.repoUrl: "https://github.com/mosip/otp-manager.git" - databases.mosip_otp_2_0_0.host: "postgres.${domain_name}" - databases.mosip_otp_2_0_0.port: ${esignet_db_port} - databases.mosip_otp_2_0_0.dml: 0 + databases.mosip_audit_go.enabled: "true" + databases.mosip_audit_go.branch: "v1.2.0.1" + databases.mosip_audit_go.repoUrl: "https://github.com/mosip/audit-manager.git" + databases.mosip_audit_go.host: "postgres.${domain_name}" + databases.mosip_audit_go.port: ${esignet_db_port} + databases.mosip_audit_go.dml: 0 + databases.mosip_kernel_go.enabled: "true" + databases.mosip_kernel_go.branch: "v1.2.0.1" + databases.mosip_kernel_go.repoUrl: "https://github.com/mosip/commons.git" + databases.mosip_kernel_go.host: "postgres.${domain_name}" + databases.mosip_kernel_go.port: ${esignet_db_port} + databases.mosip_kernel_go.dml: 0 + databases.mosip_otp_go.enabled: "true" + databases.mosip_otp_go.branch: "v1.2.0.1" + databases.mosip_otp_go.repoUrl: "https://github.com/mosip/otp-manager.git" + databases.mosip_otp_go.host: "postgres.${domain_name}" + databases.mosip_otp_go.port: ${esignet_db_port} + databases.mosip_otp_go.dml: 0 wait: true timeout: 300 priority: -16 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh index 7453c149f..f66a44b22 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh @@ -9,7 +9,7 @@ # ============================================================================= set -euo pipefail -NS=signup-2-0-0 +NS=signup-go COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh index 9411a9f6b..165989433 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh @@ -14,7 +14,7 @@ set -euo pipefail SOURCE_NS="esignet-go-mock" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CM_NAME="esignet-config-server-2-0-0-share" +CM_NAME="esignet-config-server-go-share" MOSIPID1_SPRING_LABEL="${ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL:-develop}" MOSIPID2_SPRING_LABEL="${ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL:-develop}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh index 859698796..b2e028f2c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh @@ -54,11 +54,11 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-2-0-0.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-go.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-2-0-0.${domain_name}" \ + --from-literal=mosip-signup-host="signup-go.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index 569bd9ed8..bfeb5c619 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -15,14 +15,14 @@ echo "eSignet 1.7.1 - MISP Onboarder Post-install" echo "================================================" JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ - -l app.kubernetes.io/instance=esignet-misp-onboarder-2-0-0 \ + -l app.kubernetes.io/instance=esignet-misp-onboarder-go \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") if [ "$JOB_STATUS" = "1" ]; then echo "eSignet MISP partner onboarding completed successfully." else echo "WARNING: onboarding job may not have completed. Check logs:" - kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder-2-0-0 --tail=30 2>/dev/null || true + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder-go --tail=30 2>/dev/null || true fi # Re-enable Istio sidecar injection now that the Job has completed @@ -31,13 +31,13 @@ echo "Istio injection re-enabled on namespace $ESIGNET_NS." # Restart config-server first so it reloads the MISP key from the secret, # then restart esignet so it fetches the updated config from config-server. -if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server-2-0-0 &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server-2-0-0 - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-2-0-0 --timeout=300s || \ - echo "WARNING: esignet-config-server-2-0-0 rollout did not complete within timeout." >&2 - echo "esignet-config-server-2-0-0 restarted." +if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server-go &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server-go + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s || \ + echo "WARNING: esignet-config-server-go rollout did not complete within timeout." >&2 + echo "esignet-config-server-go restarted." else - echo "esignet-config-server-2-0-0 deployment not found — skipping restart." + echo "esignet-config-server-go deployment not found — skipping restart." fi if kubectl -n "$ESIGNET_NS" get deployment esignet-go-mock &>/dev/null; then diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh index e453c0c59..18f4d4708 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh @@ -14,14 +14,14 @@ echo "eSignet 1.7.1 - Mock RP Onboarder Post-install" echo "================================================" JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ - -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-2-0-0 \ + -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-go \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") if [ "$JOB_STATUS" = "1" ]; then echo "Mock RP OIDC partner onboarding completed successfully." else echo "WARNING: onboarding job may not have completed. Check logs:" - kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-2-0-0 --tail=30 2>/dev/null || true + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-go --tail=30 2>/dev/null || true fi # Re-enable Istio sidecar injection now that the Job has completed @@ -29,13 +29,13 @@ kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite echo "Istio injection re-enabled on namespace $ESIGNET_NS." # Restart mock-relying-party-service so it picks up the newly onboarded OIDC client -if kubectl -n "$ESIGNET_NS" get deployment mock-relying-party-service-2-0-0 &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment mock-relying-party-service-2-0-0 - kubectl -n "$ESIGNET_NS" rollout status deployment mock-relying-party-service-2-0-0 --timeout=300s || \ - echo "WARNING: mock-relying-party-service-2-0-0 rollout did not complete within timeout." >&2 - echo "mock-relying-party-service-2-0-0 restarted." +if kubectl -n "$ESIGNET_NS" get deployment mock-relying-party-service-go &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment mock-relying-party-service-go + kubectl -n "$ESIGNET_NS" rollout status deployment mock-relying-party-service-go --timeout=300s || \ + echo "WARNING: mock-relying-party-service-go rollout did not complete within timeout." >&2 + echo "mock-relying-party-service-go restarted." else - echo "mock-relying-party-service-2-0-0 deployment not found — skipping restart." + echo "mock-relying-party-service-go deployment not found — skipping restart." fi echo "Mock RP onboarder post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh index d9488356b..e0d5ccbc1 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh @@ -35,7 +35,7 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ # Override postgres-config with MOSIPID1-specific DB values (2.0.0: isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid1_2_0_0","database-username":"esignetuser_mosipid1_2_0_0"}}' + -p '{"data":{"database-name":"mosip_esignet_go_mosipid1","database-username":"esignetuser_go_mosipid1"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh index c4ea74a2c..e9346235e 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh @@ -35,7 +35,7 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ # Override postgres-config with MOSIPID2-specific DB values (2.0.0: isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid2_2_0_0","database-username":"esignetuser_mosipid2_2_0_0"}}' + -p '{"data":{"database-name":"mosip_esignet_go_mosipid2","database-username":"esignetuser_go_mosipid2"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index af0d8b6ce..eec0071d5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -41,7 +41,7 @@ $COPY_UTIL configmap postgres-config "$POSTGRES_NS" "$ESIGNET_NS" # Override postgres-config with 2.0.0-specific DB values (isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_2_0_0","database-username":"esignetuser_2_0_0"}}' + -p '{"data":{"database-name":"mosip_esignet_go","database-username":"esignetuser_go"}}' echo "Copying redis-config configmap from $REDIS_NS" $COPY_UTIL configmap redis-config "$REDIS_NS" "$ESIGNET_NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh index 25f3e4a7e..20c40638d 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh @@ -33,7 +33,7 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ # Override postgres-config with Sunbird-specific DB values kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_sunbird_2_0_0","database-username":"esignetuser_sunbird_2_0_0"}}' + -p '{"data":{"database-name":"mosip_esignet_go_sunbird","database-username":"esignetuser_go_sunbird"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh index f912ea20f..5651ce2b5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh @@ -15,7 +15,7 @@ # ============================================================================= set -euo pipefail -KERNEL_NS="kernel-2-0-0" +KERNEL_NS="kernel-go" API_HOST="${MOSIP_API_HOST:-}" API_INTERNAL_HOST="${MOSIP_API_INTERNAL_HOST:-}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh index d1f460dad..da1b91802 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -15,9 +15,9 @@ set -euo pipefail ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" -SOFTHSM_NS="softhsm-2-0-0" -MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem_2_0_0}" -MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser_2_0_0}" +SOFTHSM_NS="softhsm-go" +MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem_go}" +MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser_go}" MOCKID_DB_PORT="${MOCKID_DB_PORT:-5432}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh index ec760852b..dd6165071 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh @@ -15,7 +15,7 @@ echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-2-0-0 &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then echo "Mock relying party service found in $ESIGNET_NS." else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh index dbc497eac..3734187c8 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh @@ -15,7 +15,7 @@ echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-2-0-0 &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then echo "Mock relying party service found in $ESIGNET_NS." else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh index fc3f5122a..1340a045f 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh @@ -14,7 +14,7 @@ echo "================================================" kubectl create namespace esignet-go-mock --dry-run=client -o yaml | kubectl apply -f - # Verify mock relying party service is available -if kubectl -n esignet-go-mock get svc mock-relying-party-service-2-0-0 &>/dev/null; then +if kubectl -n esignet-go-mock get svc mock-relying-party-service-go &>/dev/null; then echo "Mock relying party service found." else echo "WARNING: Mock relying party service not found. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh index b2e99f6c4..e1c066e06 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh @@ -15,7 +15,7 @@ echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-2-0-0 &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then echo "Mock relying party service found in $ESIGNET_NS." else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh index ababd0847..8277b1a8f 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh @@ -7,15 +7,15 @@ # ============================================================================= set -euo pipefail -KERNEL_NS="kernel-2-0-0" +KERNEL_NS="kernel-go" echo "================================================" echo "eSignet 1.7.1 - Notifier Post-install" echo "================================================" # Source: deploy/kernel/install.sh - kubectl set env deployment/notifier -echo "Setting SMS number length env vars on notifier-2-0-0 deployment" -kubectl -n "$KERNEL_NS" set env deployment/notifier-2-0-0 \ +echo "Setting SMS number length env vars on notifier-go deployment" +kubectl -n "$KERNEL_NS" set env deployment/notifier-go \ MOSIP_KERNEL_SMS_NUMBER_MIN_LENGTH=7 \ MOSIP_KERNEL_SMS_NUMBER_MAX_LENGTH=10 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-init-db.sh index 016500c9a..f33378e18 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-init-db.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-init-db.sh @@ -12,7 +12,7 @@ # ============================================================================= set -euo pipefail -SIGNUP_NS="${SIGNUP_NS:-signup-2-0-0}" +SIGNUP_NS="${SIGNUP_NS:-signup-go}" POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh index 4afa3dade..c727bafc6 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -SIGNUP_NS="${SIGNUP_NS:-signup-2-0-0}" +SIGNUP_NS="${SIGNUP_NS:-signup-go}" KEYCLOAK_NS="keycloak" SECRET_KEY="mosip_signup_client_secret" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh index c7a206ce9..2fcbdfbda 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh @@ -15,7 +15,7 @@ # ============================================================================= set -euo pipefail -SIGNUP_NS="${SIGNUP_NS:-signup-2-0-0}" +SIGNUP_NS="${SIGNUP_NS:-signup-go}" KEYCLOAK_NS="keycloak" SECRET_KEY="mosip_signup_client_secret" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh index 0ff1461b5..84be8071d 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh @@ -6,7 +6,7 @@ # Sets up all prerequisites for signup-service: # - Copies redis-config configmap and redis secret # - Creates keycloak-host configmap (KEYCLOAK_EXTERNAL_URL) -# - Creates empty signup-captcha-2-0-0 secret (update site/secret keys for prod) +# - Creates empty signup-captcha-go secret (update site/secret keys for prod) # - Creates empty signup-keystore and signup-keystore-password secrets # - Creates msg-gateway configmap and secret (default: mock-smtp) # @@ -18,7 +18,7 @@ # ============================================================================= set -euo pipefail -SIGNUP_NS="${SIGNUP_NS:-signup-2-0-0}" +SIGNUP_NS="${SIGNUP_NS:-signup-go}" REDIS_NS="redis" KEYCLOAK_NS="keycloak" IAM_EXTERNAL_HOST="${MOSIP_IAM_EXTERNAL_HOST:-}" @@ -47,24 +47,24 @@ kubectl -n "$SIGNUP_NS" create configmap keycloak-host \ --from-literal=keycloak-internal-url="http://keycloak.$KEYCLOAK_NS" \ --dry-run=client -o yaml | kubectl apply -f - -# --- Step 4: Create signup-captcha-2-0-0 secret --- -echo "Creating signup-captcha-2-0-0 secret in $SIGNUP_NS" -kubectl -n "$SIGNUP_NS" create secret generic signup-captcha-2-0-0 \ - --from-literal=signup-captcha-2-0-0-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=signup-captcha-2-0-0-secret-key="$CAPTCHA_SECRET_KEY" \ +# --- Step 4: Create signup-captcha-go secret --- +echo "Creating signup-captcha-go secret in $SIGNUP_NS" +kubectl -n "$SIGNUP_NS" create secret generic signup-captcha-go \ + --from-literal=signup-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=signup-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying signup-captcha-2-0-0 secret to captcha namespace" -$COPY_UTIL secret signup-captcha-2-0-0 "$SIGNUP_NS" "captcha" +echo "Copying signup-captcha-go secret to captcha namespace" +$COPY_UTIL secret signup-captcha-go "$SIGNUP_NS" "captcha" -echo "Patching captcha deployment with signup-2-0-0 secret key" +echo "Patching captcha deployment with signup-go secret key" ENV_VAR_EXISTS=$(kubectl -n captcha get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_2_0_0')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n captcha captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_2_0_0", "valueFrom": {"secretKeyRef": {"name": "signup-captcha-2-0-0", "key": "signup-captcha-2-0-0-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO", "valueFrom": {"secretKeyRef": {"name": "signup-captcha-go", "key": "signup-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_2_0_0 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO already exists." fi # --- Step 5: Create signup-keystore secrets --- @@ -79,8 +79,8 @@ kubectl -n "$SIGNUP_NS" create secret generic signup-keystore \ # --- Step 6: Create msg-gateway configmap and secret (pointing to mock-smtp) --- echo "Creating msg-gateway configmap and secret in $SIGNUP_NS" kubectl -n "$SIGNUP_NS" create configmap msg-gateway \ - --from-literal=smtp-host="mock-smtp-2-0-0.mock-smtp-2-0-0" \ - --from-literal=sms-host="mock-smtp-2-0-0.mock-smtp-2-0-0" \ + --from-literal=smtp-host="mock-smtp-go.mock-smtp-go" \ + --from-literal=sms-host="mock-smtp-go.mock-smtp-go" \ --from-literal=smtp-port="8025" \ --from-literal=sms-port="8080" \ --from-literal=smtp-username="" \ diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh index e907bcdce..2d02ce0cd 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh @@ -12,7 +12,7 @@ # ============================================================================= set -euo pipefail -SOFTHSM_NS="${SOFTHSM_NS:-softhsm-2-0-0}" +SOFTHSM_NS="${SOFTHSM_NS:-softhsm-go}" ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh index f0faf76a2..f8a711787 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh @@ -8,7 +8,7 @@ # ============================================================================= set -euo pipefail -SOFTHSM_NS="${SOFTHSM_NS:-softhsm-2-0-0}" +SOFTHSM_NS="${SOFTHSM_NS:-softhsm-go}" ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh index c05dcea21..d27bd7d54 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh @@ -11,7 +11,7 @@ echo "eSignet 1.7.1 - SoftHSM Mock Identity System Pre-install" echo "================================================" # Ensure softhsm namespace exists -kubectl create namespace softhsm-2-0-0 --dry-run=client -o yaml | kubectl apply -f - -kubectl label namespace softhsm-2-0-0 istio-injection=enabled --overwrite +kubectl create namespace softhsm-go --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace softhsm-go istio-injection=enabled --overwrite echo "SoftHSM mock identity system pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh index f69b2cadc..58088c891 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh @@ -75,11 +75,11 @@ trigger_all_in_ns esignet-go-mosipid2 || OVERALL_SUCCESS=false echo "=== eSignet-Sunbird API Testrig (esignet-go-sunbird ns) ===" trigger_all_in_ns esignet-go-sunbird || OVERALL_SUCCESS=false -echo "=== Signup API Testrig (signup-2-0-0 ns, if deployed) ===" -trigger_all_in_ns signup-2-0-0 || true +echo "=== Signup API Testrig (signup-go ns, if deployed) ===" +trigger_all_in_ns signup-go || true -echo "=== Signup UI Testrig (signup-uitestrig-2-0-0 ns, if deployed) ===" -trigger_all_in_ns signup-uitestrig-2-0-0 || true +echo "=== Signup UI Testrig (signup-uitestrig-go ns, if deployed) ===" +trigger_all_in_ns signup-uitestrig-go || true echo "" echo "=== Testrig Execution Summary ===" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh index 64e6ad806..c4f7ccf45 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh @@ -9,7 +9,7 @@ # ============================================================================= set -euo pipefail -NS=signup-uitestrig-2-0-0 +NS=signup-uitestrig-go COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" From fe995e5f8338263a882bdbfd5c3136765c37ae45 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 24 Jul 2026 18:06:00 +0530 Subject: [PATCH 016/127] fix: #302 Update deployment guide to reflect the esignet-go-* naming used by the esignet-standalone-2.0.0 profile instead of the old -2-0-0 suffix scheme. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index edb9a1dfb..ee2e06e61 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -13,9 +13,9 @@ You do **not** need to run any commands on your local machine — everything run > **A second, isolated profile — `esignet-standalone-2.0.0`** — is also available in the `profile` dropdown of > `helmsman_esignet.yml`, `helmsman_testrigs.yml`, and `helmsman_signup.yml`. It deploys its own namespaces, Helm -> releases, hostnames (suffixed `-2-0-0`), and databases, so it can run side by side with `esignet-standalone` in -> the same cluster without colliding. It shares the same external infrastructure (Postgres server, Keycloak, Redis, -> Kafka, Minio, Captcha instances) and Terraform profile — deploy/manage those via `helmsman_external.yml` and +> releases, hostnames (e.g. `esignet-go-mock`, `esignet-go-mosipid1`), and databases, so it can run side by side +> with `esignet-standalone` in the same cluster without colliding. It shares the same external infrastructure +> (Postgres server, Keycloak, Redis, Kafka, Minio, Captcha instances) and Terraform profile — deploy/manage those via `helmsman_external.yml` and > Terraform using the `esignet-standalone` profile as usual; there is no separate `esignet-standalone-2.0.0` entry > for either of those. From 5c341b7529d266272ae052fc95d8e0969ff16213 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 24 Jul 2026 20:01:47 +0000 Subject: [PATCH 017/127] Terraform destroy cleanup GitHub Actions - aws-infra Signed-off-by: bhumi46 --- .../implementations/aws/infra/backend.tf | 5 -- ...tandalone-es-go-test-terraform.tfstate.gpg | Bin 18117 -> 0 bytes .../aws/rke2-cluster/ansible/inventory.yml | 49 ------------------ 3 files changed, 54 deletions(-) delete mode 100644 terraform/implementations/aws/infra/backend.tf delete mode 100644 terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg delete mode 100755 terraform/modules/aws/rke2-cluster/ansible/inventory.yml diff --git a/terraform/implementations/aws/infra/backend.tf b/terraform/implementations/aws/infra/backend.tf deleted file mode 100644 index ff4cc9846..000000000 --- a/terraform/implementations/aws/infra/backend.tf +++ /dev/null @@ -1,5 +0,0 @@ -terraform { - backend "local" { - path = "profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate" - } -} diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg deleted file mode 100644 index 10ff45487f1c1c7bc2f1d81538a3dc7f3af45c94..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 18117 zcmV(rK<>Yc4Fm}T3g%CRozIYVs{hjJ0mrj$px=@b6D8KDN*6+Vq!px0Rw%gYYyEOq z3}ZIpJy{C^E>73(*YWB$ZiA%N%2c>BPvm^f5{xt?YdR9w-APRsV<a=sa4uJ{p$q`*W49z z6e=|j_boSMMY6Z3M*91d=Us}Lf!BL9+M7h`ES2)cIJbmi zfZ_|O75$gQMc$ne2OFduZF`n!GLO)HJ;Da^&+G}y;0U^hlXH?2Vq3#`1U8CkEIXLx z#O!X!k@G*Lcr)y*4A!(?xbwW79Ca<|)hzxvv|DxXhYp=sIvFbMkgy$B#;B5eyat=< zQzo8sD}vl}tW@a1D9TO=T7V4*Wy6*Ff5=s-@+L9vBx(~XM8w`72;<$RkY0uF>zpzH zyN>GrvcPaEwivmncw9*l2mc1n9A-{6-9&%f<-5u_Ch*_SH$y`nI%ZnTw7(7cFHim8 z7DC5oM+_L83zb8jpNWnhw3X)vj3F98x$T+0G)CLe%Hf2`=dn!z{}6Iov8!y81M{g8 z`J@OF-3JsR?}2qWAJ1{#a(|+6VMZQ<=nJ+=&8Z{!JYiwIfWS@O34`Mbw4WsR z+_O#`W;410kmzgd6e70E%o1Ws*wZzY&vHm_2vrjk+ggP#y+uEC@4l3 z0IrenYp^LL9LKNTeyS&6TxXlEw(1AdXSg;Nb|2}BSFl!JFwmkMI(>^hpZi>m*!5Xz6VcsLFU;;ur2le3?N~P+-w)D zee_P{RbzXgd;r{Q#F?)ySSQs7#l-tvgZc@TnU@$E#Ce7eIXMS({%%~WJUm@|{1~Rl z5Gp@+e3x(2%OS^TOBu!moJr?^Hy|o3aSy40bq)JgEK$K>;>2OB@VN|JqhMmZtatE` z!On}C0X>L&!iV3{ZK+oC$+;?7WR5XupPMu&l%Fx^1N*s}w06FA zi2!NB+5RIx)E2J+=1%z`s6WK^OX2f_8`9^p>V0!h0y8B{1EowLvj!r=HUntEhV$_E+)Gk70 zD~${#C6$+f0todlf`KiyYp0!T`D!f^R(d=<rP zg!l6=wi*my5zGg+?oI6owOol-t$K&erqd_aJ?nxj4m@XieVxB{@4vf}vTC|E zeteEafeYzDGi0X$UKtE7!a9jMLaiFTLb$BD3f14h9d$|&GdD)vg}T_PDJbI|XiF{4 z%F#mXMUBeMQ+||wX{J~~HngobwvM2xeE1f)e+oR|!BYq*>nUai?*+Vnv{tfnj81cV zIC!BcCt6`V7{n+JxFvj8gbK?@B_310WEO#zP$zMdP_71YW>g^DGTU@!%C5Soi1INDqAt}ZlVe)JXW7=t@4-#0y45ZFPO#cNEZd!Y%w@VAd_w}^8$=k#Z}P5K zwRo6bzCRlEXGy;BCLLLed3UxkLy!`0atx-LqTZz1l-_=#xqaNmcBM-mKCP6=Fv<9> zW@pmuM1Num2oKS5C_P;*F4}sScG%SRx5rq^Uktr9Oja0*YUMpaPv4$?S;+N&f^5?h z1WYPHj##cbZpN`3&O=hHQmNOVv?JC#!cE6@y%OH)$PD#L>nvjD<6FHzS5R^~>s*dc zIc)bW0Zq1rXr}I|$;Q=Xz9P>VqY_(9|xQ+l4boc1xlbl`t-J2m?zXk$<7W4y9sqmtb?Wqek0_^+Z`CY|i zg6vB|7=`?yJD)=`w-{@Cl5{KI=iIrOHnveF9~U5w`oBO~A+-j`TBPa-(U)2}Q?72R ze@!mkDZ5T0AL%%E+(8|TG6XpewkY3vNWq7u@#LM0)zY56_`5A!$3>%F<&Wpj`uL1mZD`24bt=6`vFrTGqhXy_{n zI9JIh^F_2%0?cL##+o>mG(!M)W??1_ynB6h3By}3mhSw~l|jbXL2+ZoRQGfEd}=Y3 zd4@~*o7cnE?)f8koYWd7t*Ep+@#Sb`kUz>ZNk_GKVd^ z0#dYe$%@`t&2O5o*#{RBJL%|V#QcMEeeg%EH+Jjfyb5&B zu$^A=Jap^t(>xFM$V|9wK+4pt`SqI!&$K6@XLX+#+-YUI9B5Ct$}ORsVh*gQX{huU zqAweiE`;VLe7wDJfdmhEm9e@WnV~13&G`}oU;$6~E{Fcqz@oH1Jl-^0)%PLl3f=HP zXsK0S0o5=wc%IIbV8XJnS<>%mxS`8+EHwT@%)IZR?-DD>e5*y zb#=Y-F+v1gj?oPzce{IH0u}xm)+odi60Gp)G*7()Rp9cM z9w@EWRA-u+-7sjGVnW7XQG}xH{eke*)o0gnEHJWK>HPX>p`V+Az8~X4H_QV_(!fBc z3mN8T-z}pYuVCttWswk5S2G3BK^dH=8*K)T-6C8$3xHnaJnST9vvN~zI|?JPqtB_Y zs>BMoNgX@loKBunf00C|8M!tQvcTWO+q->CJ)sO@ z(joa=etYY=aVH8%IT9xhai5AloP{aeeLLUkb*n)fZ#Ks|z@;>(o{7i;)bh5a;Ic;$R*)K&s%)o;Gv zd^S;_Pr#ZqU7hxrnAMWRUJnCjMO6=Fe#M16xouCmf$e}?)A*zsxUJrO3gN~-$%%Ef3GK0A=og(L z$+sY8`HQP?P0LEAXk^(*PNSA}$GCNGDbZ}jwE0l!+$<>t+o44>w9IMWYGN1#^d8ez zzWwHcC}5Y-m^g8`N*RFi=eiF)dCLl5R1!oLdJ;1MN z3~;z{DC5vkX(pF|8hCz{Ol0cjD|g#+1;|PRZ)91!GQ8Yd3#LUlg6q-;4m0ducd7L@ znHx?{6lD~Ie9~vN3Gg3$fbEAKA|Ygb72W@B008VcCxZ{;3`b$&tI9SppmG(7>Ja#N6w zj0&2Z%8cXTi75$RX`s>TD5&|Yn%hfl_>K3vR=pthuP|7%j>az4341Y%?R(?P=dv%c zFa#*#?ue5CJYVg!uv4y5zkubw>+S1buHca}PaaTdCvy;uWb#5)yW9(gU172pwJ}Kt zfn50BZBH-xA?w>l3OlUvWF80ea}A#%h>0$Q3*$>(fF5WdKYom_h~1Lgg?sK6ZRyJ} z3eKS$=Ixa~TwM$~yejS4hO#UjXIlGh@PDc0L&2Zs5aO8{gimgW9HQ`BF!nVmD7H@K z2!(UP&hGO9&ACx#y7IW&Ub`AXbi#$7mix`4AT3u<#o{1TSXC*|b=?S}-KQ13)WtgK z(!#5Fq;tzrMAiBA`oGO)G?SqaAoH_7e?dZC*g}&S1vg{Xi@H?&mQl&ob0gWPWTxJv z>()j&;i2aoqN%`w$X&4`7;m%t1y7pun77H2qJMvEhl;HdQyUIY+IAc(+zTDoq1W`G zrK2My%?a+kE|H+A0BZDq(Bd6rx28>KR?gVvde1a?J((kP%=O-Xw{Sl7IK z6khgc*lnwowMpW+(+BnE0lLIeIPz|`WERv9g>^z*gRurWMBQG{C8nB-m5b-fa0@L2%qJgL{Wm3gEw z@{_IR1Zp$Jf6Pc@>6`{<3m%jctLTel!YQ0ILSZ<#Yf8tZvmF|MZtqLe$H7|8u(~+;WnX@a#Dht_Q%xxoquX&MA+rJ6@ ze|-t=wO&Cr-1hLjVn3$gF&~i-Fl9-4^KhKfyyuz{rk2SV@Lb$*mStNU;?=+R9kc{{ zB2q){KskuNaQPH;Q$5Qt4z1)dlA-dQlZyjYgD40;+n5WMA@HQe%oHQ5aPEa(%*juN zh)GS+v8e~yhS~J(YsFbr^Sw!$?|wGy!jkE!$SS}(^0Zi+z}#Q#r^}LtSWSKMIiIod zIDF?*ll`4eoGiFce`TW}JDP&)2>t_bQ@v`{Gk$TAvo{?@Atzl>b}@9ktVTl*-Pc6H zuAo#U9&XlhluyNdw1AtppsGB*w27Ok=4yg-b@}SYZq+9qlj)QNkbg$CWYD7-b6V_T z>)vQOl&QoRw`N|;DK5&E!wS%ebu|Q%CE0g~RP!#17zx zW#pun&KngIm|`HtHr$24B3Owy3!LX#%dVV4IdWvpU&Sc!;!7!n@r)Zy?fCWC4wrFN z)l@77WFkSCqW)GvHNY&(G~kP&~PBC0S)wV`jaCL|5; zJd#4kf;fhu+{_=)p+r`Ec?N-~eu!FJe5v(zj+A0~JO4k)`Z|oo`5&e2QyTXIu1hSWi!->u9qTJMD;4q`})Ia%wAn9g7#?v4Nh7@~VJG}kZCE8;m zBNo=WdqXSQs9}H*vADB`PI_v6^y42X0b8WLVeI|uUDWg4?h=Ej$EYua+ZdNnI!`YF zs8uq6%OJg#G7=;^PZ49?nLKUp(RYHa8&J|G!I1X#sKv$bqz*=yNmKDj69XTCJ+a0D zm+z=^{QA-$ofh66aztF^M_|mzz`N)lt>YO)gX(YAUr4s>4Fo`K zV-#o>=>}F{PA%fDSoQK-kRJgke66@nc`~#GOt3TDawKi`1k#bqSa%Ly?F0O=tpZ0m zwaP;QRt`;ktn$(~*?sn5KFeFX{JNk!e}me<1bfubFdiBNRchR%I=dqrUId~1^w(@l z>7wX?L_fat0w!MM!zl&;-D^%eovgh8Px<%{S(}W%z<=;(*)|12 zs~VR52u}<@w0*CT^F~%4ceMOK0(=dyB@<6{d+1=P$%(nTsM>L&z`0LgAukdD=9jkO zSIND73J0$~_Y4*9F!jDl5RixZR1>!&4a1vH6vtQrx%_Jtm$H#h@Ow=-`PoO=1qieI zS$MtJC%!c94{UZ~J#R&^**Pfe+XtifR1*Te40Of2Uc~UJKfrUn=qmVOc(3T8rcf!wljwTgoDtguLc zTsfNv7R$bb@Lgrvhd9M?aPt zp4_~JSYiRAVc@x8owkTjGyj{QccTJ(Xm4+|!DODCA9v#@B*bR{VpUuhlc-IT%(8fb zJC*1FOGCWGVh|zOmM_p7IV)c>SXf4~2hRPLTrlcGsmx;hP@ZFA+G6Z@h}F6OiqY1k6aRi-Wx%|7k4)x0J$Ol}D=M5!m6Fin_F~^unBrnC@mbZ=Xr&r9gWAZX8a{7dH9%j~ltlKVLVM@%d`SFR9nLavr7!^~;+jSoY3fyIs>cLhdCZMVsjd{xpi}l&mJ32yCS!s=2uUL!+ zM~(WO_!~t&{-f$f7nBKZubJO-;0Az`aM&xO9~JKYq7Qv!nc5qcY%u`6JYtQkT&i~n z>f`kc0MN>;ECIFrU?P%jt8+UeTq?UPb#^8iYINo9oi&)oA|c_mf!@{yYlJt=w7vtx z-?rd);3K|#AOJK9uZ;B$-ny^mgsYq;3gl_XRqY#3o-PV30buqdzWZOKxkY4z1RM6V zqUVnRUOIZa$m^`GE)aY~p^JB2V7Tp``!@Y*yhS<%xI7kcEEAhvj*stb?}pYNV&NmL zENfNX(>Vm;ZsHm|kpFp>Gy|k_6-?;uI7}ePpTMC1CZMh<+qf2?xZ1@4v6c8?S~M7D z3Mvnjx4*=09PI)$tlmyRM4gk8k#yLpf;_PX|H8N>iwa?C!LYX5Flfh*r_c}eR!G2&zG#oFu`78hiXvuB zrBdTEE43NQgXuDnMZg8x3Clfa3Y-sN&$tiT+6=iP6cy^*7<*Ifv+7YC@aUuHT=F$# znRv!(qHjGze|HbC)o_fyQ^3m$8yS$@=7LX8df<-;+5G&*yxD9J4jo5TPU>2yNmM7x zOYaJe>JisZq*<^XGIF!JY0hz?U@Cx_&ucqH00|Lv=qDf|Lp*JJJ4}A4o%aRt<3noB z384*_7XTCOm0t}@=x5e#Hk3&-AuqK_uBgo6&K79;g$mr0c{_m;O|9s8FKnei|5>|X z&U2552u(4z4-y5;u<&3Wg8hi#-4?rG1&x?$N$Su+WHLGZ{NhjPU?J*+x^qD9bk4Tl zsNRSRHFa5&3w?BV%Z-^|NzNNbL2%q+RrT*kEd}6z3%w7?uZCuvyUNDe3y1maa9T#b zNjERKapuH>z?sNQb{8+zw&H~gSw@O8n^dGM|u;Og9szi*qY=kqZHHYodH>*w6O z`Er_$f~Ktd?*%5G`uRmB(*VlQV5fDWi*(0$&+mw)SJ(w!=X)Ah2qxQ|pgff9LY3{j zT8+)>07Y_=YWk~7ERZ#}({u#(4&jGV8$?;3MzSyg@E`;XZ$3mKs|an9a!2AzH5d;o zz6qC9rm!TkwtwsuH}0O6mPVb=;I{8t=ACW5fs(TSw5N|yYJ=9^R1(JZAx}~$Cv}sQ zq>l*&6J2{-;r+D3Wd$%wH5fq~_q0}q+||XK{|e!>J*)DmG`rjL45`kKJ^3v-bcgRI z%^Zh$$pgSbgFXnt)^mlbhJ9fMQJ|oAJUML2-ms1;m^dr#gWpH7O58UeeK-Ej3BB+q z;>k?(Q*@1$Z#OZ-+H5!Uz3yg=WQ4~>wMID-{T;)vcU`mXmNDH)cl`c)D&j^vc#7IK zCWr%3nYO6(`e>{bme@Sdy*=_5@+7=~jaG!DcIL7p45Ma_YeS@&vRo1F`MDNud0?NY z_1u4N%_ze7H7kIIat9F?2B(5Y65fQ%`A zNV+~p@@zI}60q{kA6KtVPkZ9QBs1Pjm!a%%-A0j_^t;5;)R12_^3dwhinsou1TZe} zqTcqLf*|A}#~D0lkDvbZ=W%=7{f?a{0ve_~@gz1OOp;u;O2j5t?XEw0rCq4PJ`yqc z+ND)yXSUl|qn;;of$AsLX`DxE-Qmsweg;LlF7Z-ZuYgrm4#Cm}SoBTXFn;|d=~LTt z|4kC=>o|x50&T_HM7b|vX0hx`jycz~O#8G0ot7(mFYnF{@+3Nr1vg zHb<42Zrj^9j(X+L1tXWTff%Ps7##HDOdI^DvFbl;3fr+3#fkz1Im+km*C6!=Ld*(+ zwP45c6)@i^3v)a}GSM@quiQxNT{VQ{GeAo>N)r#Ehp zdjE^xBA2V=0^eIYL<_oY_&-(vj6Z}Y?L~{5tfYPlVh?FI!k9Iy-><{pil9Ybi4%YU zA{`kAVPM_nMIipZI4DgkaaRA}8sySjyf&=Ye#)wvlt2MwFeT^+DN+DI1jUbe83h35 zN=ZyY7uAaTmXU0^ii-|}{GC86Opi+6C}=P8(8op)^=3(T*A~Fvh4bdv-S6G!YFNB< z^L$el&I_p1AaT$S7}r1Tx0FPhC&npC+c4&>CJGK9@{ziAU`NW+YRxe z=@7<*24mheW{e5AxZJ_!X40C2AAuE-IUPaIQimb)2WGjtM zFpCwouQ1KF3D|h5r*oKGH3w!rB=PXcz9K`By)yOf8a(&~P!zG)G^r2m<`rKV|N1!h z#|)7!GKVTh`cdt+ktJ5-7?o(AAg#Q5H|z`P&ZEFZOkmt-6xO3~Qzz%Ed2r*wokJhS zcAF!>P>eVpk*XBQxt_@eds8PCi1ACjiW+yifq;)+{Ir8G-e>q=f;3bCs_KnLEJ-Pk zp#XB&C&W1fqOK|JqCqUii}K(d)4(6{qLHmiY;1%k$&fSa;UAkj(cr+eHVab zGLf2%C5AmHiR0Nzo%zJ|nUe_m7tB{cB6hhv%RusItA$N4|148X4jgNet984&K+ zMp}rtON8mghEC%-Rj3&AVvx5?VgAh&S8XL2uJlWTkfmPlCFVW1xrWg?dY@abLKpx; z_aQ9on*e_kkd9O?O>PgJxu<8po8>17Zey9rGM0^{3eRyADQ8JqpeO=_+7NRPIOw71 z4#la^&`j^{X90EC;E{U=8HQPAu(1HRKn+S2eE8HoH+~7^o0U(R?y@}BF}1Y`p=k5A z4NT@E?Mw(0$UE4D`T}?5-s{<c?SBhoAb?Ms%uv;G?9EHgX*#gHO|w6jXoTz|XxFkhr-FNHZx95&%$*w9 zU2rHzN8k1tN}|Q5mBE7hV3Fx!(CqSqTFnu{L)`KK%j^TmMkYwvAp7KpexW zUdah<*a3>+D#`c)hy<&+d<~7zu-KX8pN2p;+DBjXalI7gc{i}4xWN0Sq5g$nRn;wb=M@wD>Fy^>$Cd}O zR`M}-7ZvfstHO;qM%QoP3vVKGcjykG@7+D`BJd)|?%POTtBd`$AcWcY=C#j>_ioRC z#7`(p;BE?m7rW8!j3rj8l(~dCX{Wz1o9(&_NE`pLf!tZ!szwlLyFHmKUNcGNK}}RB9*4PXY(c$ zT5mmsdTAK60H(sc9OVKU zi^NYeIkCoo`6OHk7lNQnCrGV+edx2mnh1_5IVGzGm@}b_LL{yS{rQyp5k#BcubNK?@ z$Qa68swRNU@6Qe{wA*NlPW3HCOo!wIm_-}*cJ^-5$a#OKUB@nZd)5Fi{$w5)gaV&k z>a;jo@9F}Mp%VezDL=Z$w2?0qm2mjotOOz8pDIha?$$UW?a`2HO8QpLWtkNK5HE2i z8PyMG_Ig1?aL)OqK0KGg$^!UbE|iD>#+EZ*U@XR5;U1?xEhyD$u?^R1R@RVni`+3W zL7Ba7(A2xsf(&{3^%;c*tLDuqHQ2)4KA?QCfN#N#Wjn9S4mwpuC6Z-IAR-8F<^sps zPSRDS&Uw5WUK}5sjyOU`=@I|A~Nv5e4Nowe!hB_Uq7HHD_WKp9-88K|jAmC5gM2 z(JL#(y0=IE?Vs<9pKs${J|rjo6TXZ6d5br&zT-mO$v?uXl=k>-d5mA&k`L0kKS{0) zI&%17qxobdz5~E+5Ma+$JpkT;(h}UXPW_tH(?-57(k=50LW-(>GwZm`vMJU{jM~qq zf8ZOw@v8D%ws@TF}*w)g2)5U_EhTnaNAi3BZqK!BXP!VV9uYHApGyoB!qW zv}GO^kIob>Cnb363m#eL;2~$gFvTc_9Lmpxcxf0GM%*?swXTDyzxX!JG21-&78=P0;4nX2)(@0|+=jL?hWrE}8Gn+c9NPP{#m<$}a z*)ezsho$#eP;;ogk10PM27vX?;5$$v6DmW?mZGai!&p}mqqV{0zOVsAp8YvDqo+7h znX-@t?UDlQ%*q@%g_5LN&W_k-&Yd-D4g@cJuAkpU(uCZ5K4DDKW2C{ufHH&;$N5R{ z)NtE^t83~;;L>_)5*w*MvzP^}=uE&Sz{TqXV$#C&x_Z}(>1;Ixswcdd5a&aIRhu&a zIkU~&s!SM2q%%aV^ZHg%7^Q|s&b-_CGYlN8m!-dki)eQdcfhZdt!mpVp>1kG%6*M4DakK5PACU zOyV;!1p&a&y!g4V|I0YuJ}XWiZyNv_7>$KTsyh9Gw39j)pR9lG-DC?vQ4$Nb#9l$G zV-SS>%5wJ0 zZV42z#%s^!()U=QM=C69CGLNQ`p@0`@*_gq&VPmx0{9L@C0H=>codjRsX~hub$Jbf ztih`nG-V@Nl@oqcqsaXtFrX`2(%c1pD#oB#qKn82g?Mzb<-*eP2ah+)V0q+hsEC}4 z&SA}sm>Kl(i@u(F{bQP{628829IQ}+ctQmsO7E9&okFy&*mhL_%kQ?)=KSS5sei#r zyCq9rpM1iU5k;#F`p`O?hFg~FLUa<~{G4N~vMFSa7n6Jeh6Cs3#H&d34V4OVMUZP! z(cCpiFaNOAMxjLDVjG&?~w;lG|zn^M6 zB=2ZWU?^(GZywu9TTEvwi1FxZs6aE7r%;4=<;tA1bqH06Ngb9FkV6dC;(q@g#^Iqg zNhGJ_1oKWeliA*j-a#r1gib(fg>6Qnr|y2>WQ9^DjX+cYf7Rj^2DE13_iAoby{FS| zE-o6M*|zhE3|H6oZ~K7=i|Ii*FOY1<*s@OE(Bc`FN05<}Eg z`?vu94-Ktw*MsQ{^N9T!Nkv#q(bjmz_Dz8WG&;R?tIl6Uk`w@J?E6!05B|8vd=a$O zZE(A)!}28ZdZT>|_Iht~H*VR;u=7oSGW8({48y4~wIc4wj~fvqybyK(B@?d6W zp2-X~KTwdU3*;yE3I1ACRF&AFBIDb}FdPt%QH%2P^`O|73=vOLBV@L*vcdt!{uBWB zZ(RwntV$@-P(AF_=kXl3mcDb%QVu*T9Xt9AE=@z5B8?-b7Ay)r5#O4dEPa6-qXw@$ zON3$pb|_F1wYS_h>o;KEYrN~fb-Wa3={%+3o!6l2xE784!?ZOe0g{Jg$)E( z=cB$|0NvuQ>mX{a(W-!~W5ZV-2(Ef0wrb?8g@m*_;R|ty)a9;4=Ezofgs2&FC(qec z^^F=BZPeU2vHk2wIcM0)ssgKu&TZ{@fs%<^GIy|F!DYBn4$H1ng43)e6pC|UG!%^! zqtb5rH6?E8+?h{jumTvm0zZ46_&dsg@1QGHwEhp!G+5N9b_nuRxvZuEkVK`9Vh^8P zbMOyEQ|DqogsO7)^c%G*{g4{3d=6cw4!Qy+-1%?VwbZ#v8}lMp`yTaE@8%B5fwWZ) zTUw?KUJ)w5QD#!fkr#r#6OCRG@nGi<{-ZI87kcbH_6kQt;xN23dybgwLTH|1^Dd)N z6QSnUurN_Dth)GFz>TYdpd2m4g_T;o^zZhf1v$4Wk!hq`QgdI4@9j|2vGl#)^ApoO zmO?iCa+n!yslS6R=T~VWV|nxUuI~H4JB0o+;g{?R>J{G&~Oxuz*!@j)pmJTO>M^Q22@l)caXSt%VXnFiDHy3a(kWO8v zD3X1MK`o8s^>&{VdPj`sonV5sWlP(8BEI;q-%;bFU-2ap0cO35g=z?=Otj^VhjK+;zTiKe7WmvH}d{($Qon4-rlF;ATp z^)uBY(W+Y@OIJ|Q6rgb0^a4YCA?zB_ozdM@=x<&X$g7I zOaB5!QsTXC$4UWf2u8^F^MQnv-pu32dK~5(0kW3sxc~)*<+I+-GQZaeUy=?w@~yLr zCqgU(rzg*FgR2zOMJwh;qvi$1UvWm+miC0S+6>){W2|JL{D z?s7jYS!5xa;iI>P{I55_ebDtym&zd9Mt~dSO$@u-3|UzJ5_$M$^W>F@5!0)vh$SPa zQDtUa^oK{b2j;{bj4YXi&`#%`bQF52(LpZF<~Y;3)rd!8#fN|bj@9YzHjReXTPg~E z__)*`+>zT?ib$}laN6imk>A&7y9s~*G~`!#^mHudFJ9htbz|4j0iPT!CU?Zz;7#ZW z?{&in1!{Opkb5%zCA_SiDWk(&$)F@jjVrIGl_8&ft0bObXJz1$1zs>NxM;0sx=LoH z!PjAiLLrF8J$=J#Dxyxk4IFYFes0bglJ>F}hl`ZNmn$ z7lVY8d+>d}oxB0y0E{$<*y{5SufJ-q%4judXaGoepHs4}5X1U>mU4RvT&)( zh$%(KYY=Dki6ZRJ+(iWls$JUGx!TJUM>K{UrUVAhL|i)AvrJR*~tL;Pj>CD{sJ_Y;MNH1rRXx?u*^nn zL}E5QSu4ndopLAV+V@lW@B(g@lD|^RqFR@ ziT^{fpbdilOOwCT+Ao-G193F8YY=dJk!1(- zMx^NxAQxoyacI|b!y80o)W6q7v}Svwl4Acy^@)_7=`A10YY*A*zBD}d4Ygs-hnt3M zP{Qq8eRc?U`C;vUy`S=GBK^o}9^iwk((Pv0!%^?ARyd?dU%t(BEc=Dj-irQYomefC z3rJIqIh{g>)d~e&R#Mm81b%V35u{PX0ec+zU_P0aubU3I3_KQIyvHT05v0a_wzcB+ z0R3|n4u>f*@LV3XXIATUV`>VTkw}QH?eFct+GQ>GM-%0Z2l6EC(%FZ~aWS*9(+t}T zwA(5iunvcChV;>vBJP7!JDZm03G3U&uU;MXU9YkNprpVYS!aZgjlc$|tX;zp&n`2D zVv8A@N6>R%3d;%;n=}&g7_S%Ks6_ zMt3qTKQmv3W%BQ(SU2k__1-uyDZ8E-T1@f~*6B&a!{c3nCecZzTF9L(+E4rTZ_?GC zb!@P_@d748`X)xRJS%QA${F^slVK1uMjcd!)^Xfn)61GaepNBG4itN|$6MJoc}HAB zH?7jR>gzanuI~|amxV%ehr;$w+eLACaEtbRstR9}?;GUl2!&o;Z2Gpgr8OHxTThqM ztd;-+`sO1^Q_xDs_pzYh2|4OX_7>4|bLD*R(BKVZpjOMdHC3+u_M{&x5Vi4QU0XPr zPO_-ACwOr#-U=DG+Ja&$I#cO+<*RHSI+XxqnwZ+bv`hD9;Y_9h znO0MK3RUc+qb2n!%wqhoJmU+HzWpc7-;4gY5ac~t4rEK`8VQZn4ED*t?Ca4w!fBDY zM(bD2BAX86ZIJtM@CswiJ6V%duEM3ij9sft&A?19xUvi9LzdeAu%~vAx>^07E5hNF z=2}*`m}ky^Ua`92AexfH?-Hbb5Jf7dGo06jDkJ@12LRX{2B`v9Yl!hfPd_LB9gZeB z&we=-JzUZ{0-IJPV4%7w8);#hcxOJp3aDq4rni0*%Hx!Ek_tiL|BObD;q28oRFpiH zP1&SZ^y=HhbIT)LxL*gPCh7qOzau%g7Q3;r6r*bUKy8Ro;%sCAe+%|r1ypckx(4be zh8{FGg~7Ew7)I;`Sk3VI7<+%rn?|gDDzZoAv7ows_KHm4DYP!107=EG&(mQG>K$ZB zFt$pVO|wTLRBP$ETilm>y8I2CIfZm&ny5hPW5q(iWzx0H!GRLysBT64j_YScWuN5( zfoQg2i48lNguF+4$07tKibbaWWaWoFqf57J+ILu9hM-sX_^5t!+WZOvD~TUom4ST} zaC{brCV}<5N_=GG>a2*aD)pDnu_Z{^UdshRy=HgpGuTNT$vgmiX=4Ws?Qwg2S;dF3 z?9J@ocwZ8tE}tyzcB#fVPgTBVO;}OJl;94v#i*He^RSMPWNn;Rn+I2fj~&ntTjpBi z3U{_d44~Ol{hj#EF5Nu$-ibs)HrEV3Gy-!7EDRB1?nF`~RiMXET16?Ue@9%^U578V zMDDiq)H9|{2NCK9Ri>NblF4rVKg7{jx1!e->XHBaZ`^@Ym#6VQlVGb9MHnmMOi+#J z^esgi$5@QFtIFw|l63@0Bxg+i+EB;KbIIcFhJ50o`>@M3;7*m3%t$Y%+#sbj0U2Yz zy&lfX<1zp6Ys(BKV{MMhi&A~pgR+Gd^*G(dA8dYRY>PW?8{U{%(VX5#wfy&V25NAB z{j42TOzFyq$5WDQ!6n$Gn{j!12~Ww$+u~|!sF<<0MBzgMi2phml>svo7y9Gheds@N zif-sd;?;Yl-_J-a!F<`ow-c++ekUsh>Wqzx_-*exn*T`wOGo1O*$Kq((X8cp9;0J; z7Y*X8G0a+H&!2y}nR!0hqo^tZ&0G*!d&~*6neFs0`Hq))f5+&~8038^;!IU2FJ;!4 z{ACINYX^{f>)Jid4e!P8@mv6cQExGOi`KmPKnns!P-jwcS0zf%JAsNm!NGZtGUKke zb}>v=%)ibYo4eBYq>{zTEAlFrRn_!FI54|6kRiqey%S@?uEKoBOi*P>iqD}>Q!o;o zyMI!PNcD#80KT!@WQ=fTOEyp7-Zt&I6dc=u@x|3ro%Zfx7EfqrD@sErT$@bRyjfMV zj4H9E9Ky9fms^a=6QX31y3j$)qij_iFx@Qm#u6dQkL&WoP~|b4{&p2^ADAYC3ZL+7 zLE?Cy8Ez1Qz|`evNLkb5aPR*2VbwmjW*?Owr=*nb@hAm*9-F2a)|kkT9ABWF%h(K6 z0I$GgbHU|pFV;^4V@lXjc_Gp0;U(71KN5k7SDa2`aD63_o3UFwrs*x8IqA5fZN6cF=JpYta=JkuOQbFh)Jt{_= zYx=~Bz;-cMG#2f$pV}q85~*#U-r%(o?j3zTRz7c8W4qCm2s)oEfH$YiKL?P0;V7CZ zd|jGv(9WxC^Bp^c2Z%Gs*d*v1RUg%OV1bQll^11~3#}G>JHoyGgqC9k4gOb5$%uIu z4EnNp%y`$h?DLIbQ)opiU}*&Pp*r&L)5DhW0xg5dSSM5n9{gL;VDGMmf(gwYRJ%O<2vqitF-}p?7`=N zzdLHc6(?fXL$EchyD9c5f_zlxOv}TJyK;7u0kj57`7KGrf&ZP<>LKI!{R79P>e8_| zhpg*sN;lqE33BDO_{m=jML|X*r28mE*+T6rZJbp2@RXkP%Iz7bgP1I68~_J?9jftS zzVhz8%TszeEbNBAUUZ7+7D0pX4Y;QvNIGI;e;>`l&l~)lqsPNq|4tOyX_d9A?)dqu~ zuizg3L(o3bCLKq3;Rk{HhS+pFE`v>kMBDh;b=^UPXQ#vWYNRnwP8-kCFoHS3O|syb@d3`-jQoOk(b*>;CVY$}U>fg6jAgKt(CJrR4=UQl@gzE1N?HC0_=7R4FeSp^5UlRpHc3;7F5Tm?0^hPKfSm~S=`Jl6+Y(A8Z z)D#j)jAz;B{3Fw!un_THY+XX45O{j*EmFNzr4}|e-%w(?>!lQlht)QyOl|22MS(vV z-rRLNu=2(d&4_?@L3+%Te~GDb2`GJu!~TYcU&+Rb@>ic(kE^lE2nMFT>6Jd99D;@h8@dg88c#&Y&cDMX^I?EYUJa|UQX@@S_t($%1IKRweV+9PD;4QHdi zlJ*L6TB2xK0eY4H^m7V&%7&}iqar|>vGYAj8_tK9daEGQnwh+gq!BEUvp8DlJ*U$lL{%N8}@#xHl*NIL9K@PjG+D_gpfip-_Uqp0`4q zV;#5*?oH1rLlvDBp~MVT?LURl9P$sR?)yF-!RhRet{bT38(b#LTPOKhw!31{1;|!R zQb|5e8Z7_qgS%b5h!~8M? zbJMWwL>T=Y$4Vx0PD6u5#vvMIm!Kqn_5~$>n)#ryD&T_0$sF(fq*qx3`m?*6LmEve ztxf9}6!4`qb(cgtAYmFu`>TV)JD_vkeL9iomsh@w6c!d22-9HlPz0w$|0! z%(>vDmyodUk-e1Phm$L?1yyXBLXjT8W!wFZdG4G8*Z|Mq=?bGJ@s3N<1K7!|b$Onm z|H-XAvq6R*S&YEEl<5D>3TZ&FUt8SLRP@f1EqF10CalfjzfITiM1{Q08V^0FSgzbsSX{6MdUcrU#D@7&$ zED^yS{q1Z~26a&7ZI~y_YUP?{P$vkp(&v$%Mx*t8TGSwL(KxBigtdF0kvvt-9=n$e zo%So$8zQu-G@>AnKiAch(oC?*d#OYx&$>gA*gMoq_DUZOOK|#UlNTwRcE>$Y>c1=N z9AhQ9n*cctU{E+NetbAmVqB_3uMKKCuA}`~d*NTMzLN*y<9n!KLif>-2);S=(lP=L zVRl=!W%pZWLDL@I$nS{;TDrE*`Tw#Z9Icsa13_csGo Date: Sun, 26 Jul 2026 11:41:25 +0530 Subject: [PATCH 018/127] Update aws.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/infra/profiles/esignet-standalone/aws.tfvars | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index e91ca577e..8aa550360 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -7,10 +7,10 @@ # ============================================================ # Environment name (infra component) -cluster_name = "esgotest" +cluster_name = "esqa" # eSignet's domain (ex: esignet.xyz.net) -cluster_env_domain = "esgotest.mosip.net" +cluster_env_domain = "esqa.mosip.net" # Email-ID will be used by certbot to notify SSL certificate expiry via email mosip_email_id = "thisisbn46@gmail.com" @@ -63,7 +63,7 @@ k8s_control_plane_node_count = 1 k8s_etcd_node_count = 1 # Worker -k8s_worker_node_count = 4 +k8s_worker_node_count = 3 # RKE2 Version Configuration rke2_version = "v1.28.9+rke2r1" @@ -74,14 +74,14 @@ WIREGUARD_CIDR = "172.0.0.0/8" # Use your actual WireGuard VPN CIDR # Rancher Import Configuration enable_rancher_import = true -rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/f25prw8zrsc959n2bk25mn79twtwmpq6hpxphf9xt97dhbm797r99n_c-stb2m.yaml\"" +rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml\"" # DNS Records to map — only eSignet-relevant subdomains # Includes hosts for both the esignet-standalone profile and the isolated -# esignet-standalone-2.0.0 profile (suffixed "-2-0-0"), since both are deployed +# esignet-standalone-2.0.0 profile (suffixed "-go"), since both are deployed # side-by-side against this same cluster/domain. -subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid1", "esignet-mosipid1", "pms-mosipid1", "signup-mosipid1", "healthservices-mosipid2", "esignet-mosipid2", "pms-mosipid2", "signup-mosipid2", "esignet-2-0-0", "healthservices-2-0-0", "signup-2-0-0", "esignet-sunbird-2-0-0", "healthservices-sunbird-2-0-0", "healthservices-mosipid1-2-0-0", "esignet-mosipid1-2-0-0", "pms-mosipid1-2-0-0", "signup-mosipid1-2-0-0", "healthservices-mosipid2-2-0-0", "esignet-mosipid2-2-0-0", "pms-mosipid2-2-0-0", "signup-mosipid2-2-0-0"] +subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid1", "esignet-mosipid1", "pms-mosipid1", "signup-mosipid1", "healthservices-mosipid2", "esignet-mosipid2", "pms-mosipid2", "signup-mosipid2", "esignet-go", "healthservices-go", "signup-go", "esignet-sunbird-go", "healthservices-sunbird-go", "healthservices-mosipid1-go", "esignet-mosipid1-go", "pms-mosipid1-go", "signup-mosipid1-go", "healthservices-mosipid2-go", "esignet-mosipid2-go", "pms-mosipid2-go", "signup-mosipid2-go"] subdomain_internal = ["iam", "activemq", "kafka", "kibana", "postgres", "smtp", "pmp", "minio"] # PostgreSQL Configuration From 6e4fb0ea7ff124d6ca0b7765555437d41807373f Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Sun, 26 Jul 2026 11:49:06 +0530 Subject: [PATCH 019/127] Update aws.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/infra/profiles/esignet-standalone/aws.tfvars | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index 8aa550360..f38f04b72 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -81,7 +81,7 @@ rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/ # esignet-standalone-2.0.0 profile (suffixed "-go"), since both are deployed # side-by-side against this same cluster/domain. -subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid1", "esignet-mosipid1", "pms-mosipid1", "signup-mosipid1", "healthservices-mosipid2", "esignet-mosipid2", "pms-mosipid2", "signup-mosipid2", "esignet-go", "healthservices-go", "signup-go", "esignet-sunbird-go", "healthservices-sunbird-go", "healthservices-mosipid1-go", "esignet-mosipid1-go", "pms-mosipid1-go", "signup-mosipid1-go", "healthservices-mosipid2-go", "esignet-mosipid2-go", "pms-mosipid2-go", "signup-mosipid2-go"] +subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid1", "esignet-mosipid1", "pms-mosipid1", "signup-mosipid1", "healthservices-mosipid2", "esignet-mosipid2", "pms-mosipid2", "signup-mosipid2", "esignet-go", "healthservices-go", "signup-go", "esignet-go-sunbird", "healthservices-go-sunbird", "healthservices-go-mosipid1", "esignet-go-mosipid1", "pms-go-mosipid1", "signup-go-mosipid1", "healthservices-go-mosipid2", "esignet-go-mosipid2", "pms-go-mosipid2", "signup-go-mosipid2"] subdomain_internal = ["iam", "activemq", "kafka", "kibana", "postgres", "smtp", "pmp", "minio"] # PostgreSQL Configuration From 32ff0052e2d9cf93206a8539cd18fbf70dc682de Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Sun, 26 Jul 2026 06:39:48 +0000 Subject: [PATCH 020/127] Terraform files (encrypted state) GitHub Actions - aws-infra Signed-off-by: bhumi46 --- .../implementations/aws/infra/backend.tf | 5 ++ .../aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml | 19 ++++++++ terraform/implementations/aws/infra/esqa.yaml | 1 + ...tandalone-es-go-test-terraform.tfstate.gpg | Bin 0 -> 17601 bytes .../implementations/aws/infra/tf-plan.gpg | Bin 61212 -> 61233 bytes .../ansible/esqa-CONTROL-PLANE-NODE-1.yaml | 19 ++++++++ .../aws/rke2-cluster/ansible/inventory.yml | 46 ++++++++++++++++++ 7 files changed, 90 insertions(+) create mode 100644 terraform/implementations/aws/infra/backend.tf create mode 100644 terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml create mode 120000 terraform/implementations/aws/infra/esqa.yaml create mode 100644 terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg create mode 100644 terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml create mode 100755 terraform/modules/aws/rke2-cluster/ansible/inventory.yml diff --git a/terraform/implementations/aws/infra/backend.tf b/terraform/implementations/aws/infra/backend.tf new file mode 100644 index 000000000..ff4cc9846 --- /dev/null +++ b/terraform/implementations/aws/infra/backend.tf @@ -0,0 +1,5 @@ +terraform { + backend "local" { + path = "profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate" + } +} diff --git a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml new file mode 100644 index 000000000..720fc904a --- /dev/null +++ b/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +clusters: +- cluster: + certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + server: https://172.31.64.165:6443 + name: esqa +contexts: +- context: + cluster: esqa + user: esqa + name: esqa +current-context: esqa +kind: Config +preferences: {} +users: +- name: esqa + user: + client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/terraform/implementations/aws/infra/esqa.yaml b/terraform/implementations/aws/infra/esqa.yaml new file mode 120000 index 000000000..1ea779d1d --- /dev/null +++ b/terraform/implementations/aws/infra/esqa.yaml @@ -0,0 +1 @@ +esqa-CONTROL-PLANE-NODE-1.yaml \ No newline at end of file diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg new file mode 100644 index 0000000000000000000000000000000000000000..5be6c905cd3caea7afcfaa80b5de5066c03137ba GIT binary patch literal 17601 zcmV(pK=8ke4Fm}T3Y1G_N-;fkga6X%0nODQk!AOX#HMrk>CMvWnM4s4WQpnll!MER z#(ia5s$8#+=w@}A?Iq5$dTuxBW)Osw0$$YmH7s9}W(xSCbAX;?0JdF`$42C%#Rqqz z&p91B#YMCqRvZjc3}PA7jxUgQJ-=RK1*pap73c@+1RTrjKp=gt*#gAzH6zBT{fB^r z5PxF--&(EbO?*wVzRYNKgM^8ZDAeV=N-aG5R}Rp`Z&7g<9*->N20kyrOH&IAr&rOPM5-XSo}I3yiI6srNiOE zw+9U?^ouR&CXT3$nKmiFEXD)QF$8#I(ULqg={cd4{F^rT$C`zuYmCa-hGbbmwPfn( z6uN7q3tj)Yq|OCeLk2TPWWyuC1&=GfHjbx zpM}}m7T`Crd5HqM+~S9t{YZoF^EoWAZ31iTV;6N~4U?rlB1=DH>+DmHHclgnGgt%k zElqtD$Y5ek*DVHAduoRSC^eT1DHsuvi56JacJ}#~GWM8j$%{Qn_jQDD*g;!)_GB?z zFuq8WB_|cT$`fch3t50?7WvM4eXsPTgs*m!<_^#~Iqfn%)?@`C@Y-~~iO(jfdks-$J&|X7S1^+@A1rQZg*yyF-r8GF z7QpFJDMP-ZF={=KH8MV!L{cv{)psM^Hp^I?gR`^XS9_J%w_EE$d=qsBQGzN$4lhZ> zPO`ccNpQ=7DC`>eKiNi!cUWk&RsFUHN4m$CHIDO!6I8CNUbUPHgqUmT=C$#6=IqtQ zkjLCW%-*HYB~7a<@DCOxeOzfBK1uJX2iw~cFM|cQYiMuL>nw1{ZT(D~p~~Mh&mP{{ zTmS6ZB!u+R;R@c<)xjt`brEdLLQHrIZ+@GaldIo$B^D8Y zO9CSxa>@AUZl)Q1Fgl~EbtWoaUXDM63j3@`e-J0h?{p{pLI!&ljMgGPrxpt?E=7Yj zjK`Cg7xj2NGAeS$$No?v8&bUWD1$Xk!^;qtb;3mccrEX>Va&Iy7Y*So4Uf~ z_*0!|U$Q;M>KYLtNo>&D>fgb9*4_K5{FWpT%L znHUM2DJMqss!0Jg1zT4pUBCVc?NJkbf8IpGeZ(|JiB+o<6cU)>`WrYCQy?8QH=1Bl zBTR&~qYh)u=DZ&WgpJ)#R4>Tn`qaU;|CV{&*OX@=HsSJ#XEAromEsFJ=dS8Ust1SH zG*hS725DvyvZXBfLA<0iZ-pxSH}dHWh3~AJM~Byeh01PdBT*wj9c)IfoeU+sl#t96 z0r$dRw?kk~EvCw$!OG_NrikvcN^WBLQYrt`|9w>lOghp*oEmiL>Deu`!0Ooy%`yQ* zF*m05Q4y~sFNzb%1zqfEwiMcv7|p$)BXekjTc#tgPw&<}^(=a;7W$HA&$!Us66F!) zaE#ZIP?K4oPb|%d^ZOUQ>LUCs#G2wKtph;RK=k!%)UL(spYP9g#i?XUh?)6vnAO`m zfc(q==&0OyP@XFW^(NtY+J2G%V19aag`S zC#MU_`Gp|sC>yd?;|Xc_5Ma%ta&h!ur9Hz?Oe8+dAcC+0Y&R2!N<-4yTF+SyQ?(!hDn=Vib0xW!1N$%{ z7x$6ZqMD6jN1R$3_SPXJ_7sc(iXKLn01?jpX|sy}(LvC6GJCefG@1awP`>()5a&-k zyPx_!efcVT4}6S3Fg%ySxT~}+SsA+(5x)qr{!i1)GKu^-d{Q4t4mY4>GC5v%7jaev zBY{ONO6=;N+4C=Q%nGCF##V)TSYi8g7U zdApk|`dyhYOcM!7HUNMt=GK1{-3s=N+}PF<5a>;)|9#rUTbCP0m$?h1%5HM+=>AP|6G3%t3sO z%7VUAV?`}G>XXa83Y%sCKY{Z&s>|ht!bVCPo6Iy}c@XTvIgE3*S|AWrKI{~?rP|9) zw{tZ*&l;OZEsV_zGyu#>aR#Dr@0Vr5E~*6;4N}nHxNfF&7_8IN_u5XFswOBYi>^ca zHTz3)V_|N5fG2V8oj-+w*E zK{>P?&3%+dH16XaEVBN0a@M05|6Hi_<~4|ZsxEQZUj{UKGdi=uBUh&g(d#3mV5!9a zWdR>>6Qf?W{TyB3L&9C0z!gG)iW(tAT}ZUydMVy`Ix&6}wWxkqS18~usZ=5)CTq3` z5lxB+^3BQ-8pBzbei1biBNDlG;#qY{J@RlUEfcL#V|EycR5YH@%x?W+ zBKYH3PFlww_=1Cubskf?WH6v$WkysdlM)Xo(j#6Mg{M`uf`b(yzqYX~0l2L09EtSt zX`=hV3wAd6KySk+gyMvsDxYDlT~&vPsR0s9qNYpqhx!~4_&1ZfUx4Ul4`U93F=#z+ z?IFL->)T#~!!aTHQ*5{~U7ce-_qZHwcR7BFEpK9EjRJJ}Ja?}4!uNt+_?yY+j&$=c1G)xqoSLIq5J8b* z5l^MqQr1b#Ye^qMZ8Qy4#_Suu{=%oZItX~S-NWp+|A6X&un-bZc3|~a z9Ab`B46u*+>~U+$7QaXO{2{6;F96#DKHG;(&w7#_P4gTJWDQH5#Y?zv(Wg4qT(2Tz z(oxZ~8^oGR5&$0ha?Xu-4P$)@;k_VqY0GOKDLYe}TEmXYo#{TMSGU1>B|};tx`Yv0 zmY{z(<)uo=dXw?t{T%IKgGzd7l+~P=M*N_&grl+OaNlu&T>K3NC-{|^bhIn%B6@E3 zZq2#X$jQ8JD;+XdHzozD7*@6|(h?$2k4D#|6V{IV@CX}G-W zan~X>1Lup1lF&WY9X4;^P&&hV^tQu&ld0t%vWyxppXxhm~`PUJSTp z;iKPs<#nl?WJSj6E0@{mnWF7khB*9ZQisMT#CanxIWDx!20Abv?yD7uz_G5<@`QQv z`MGid$nt5cC}{d-D=M;g;H}Ly#xu8B@|&v#oQnCWsfje5^6;V9U>?>P&H#+1ldkQN=)%_3HJrKPc7l=8s+PP3n4u5@j-ZienyU2N(^3 z)|ITkqj8yn2RVU(Ru^fFLu$oIpbbIog0X(UNOq%tXpnQA3XzF}EdPJ7;i1eKX`{Qi zUB-e(|9y|v(B~v`DgLbrHF^*Voc>-+g4`6;t7w5hV77i8A8{Q(0Cs=f26mZf@mEJ! zB?2ehWBlSgB_sgpCU#{+eYApdI)oVs8fYdD)*3C%&w~!aNRh0yz zJamtTkpP{VmS1;!qfYghXQ4orfqO?|n1@)TV!JyUp4__w)C+roUmJxnskOmQFoTag zh3|9b(e8cz+|ZX3d#}AX!&b4*8i9%{sYNQGKg0)c z<|&~5n)d@2nYwr}ZOe_NAJzzYIZ^~qzXcW^-}tJJ`no^vRgEodHB>4vK+QWoRcAn3 z{X<}=D%H7I7$$x)fs})^BZ~EC@0^Gpg}%Fs8yWGC~ z?R0f0cd-ZszhGnS5m)RpMMKEQTQR4|m*mbFAN;Hp(&FB_G2K`(9G~t5^SRv?0(AFT z|6fq`a^M+~rZ4SO!NXU{c=#Adp@1i2(?pPj-Kznb8rnkq^nI8EgMl{}8VW~iTkL{{ zZ5byBFsB4Ld*7#%-A5Osc=&g%$QYG_cX2VDqJCx8v*duU#A=QV@oQAg=K0U7S)bQ= z4WYz~JbYcWmLfHs22R;e#27@>w7%^^*)L;ZsBO1cc|_C-7~Go1TY$N^us8zg%uobdK#udmoxv3PWZotCu3QUlz}_hKi1 zqG2E#4(Y*~_V~I!=*Gh-^TF72`<+f`j}tk=MhQt5r}cswKQQwoe- zAd#{T0edcdU({jSYm+(;_nsfC09+1Hs&^)>BUQIq`&b{tc`?edc8^>bPN0t?n4&*YiNVFD!i zhYb9(Y@yurfv#Qdqxf(zWxqzByZ}9Rm&}6Vc{vz)!3CK- z+-M#En+ie0(aPn`7zWA}WGL;^#(Q|mkw=ICE_#kVJ7GVJ!5<06>ZyEIVJVIN+o`<1 z>66L4F9Hyitj?{?lNbiN!5hQIk8Q@PKp{hRNlxAt(tm^^!U#`ZVP+oSqfI^2ElikXxT_OaLe<)#ShKwWLX>@oOEz1gk&Gb8=A z3tyO7=4-Mr%CjHlZic}+bN?^~A0{a%{Y;`t@Cm|sBLL@iH_E<0#DSi`_B^P>>FExK zymN{4-7!!x7GVfUxB8LD;I#d}s6>|MQpi&Fqo#;y*iS6+SZ&F*i%qZoB!i$po760{>8H5>&cGAX4Ax-%Nq~%Q7 zRp^uz#L;>DAkz(8*bDF2M6=U6BDbZ&JemBm2z5}d#Mz7jn@7b#Q`sr; z-m$f`1Ok3q-u@YztU3RXbG7B$3KGMRUrE9Tj#xIWHNE3c3IQugaX$gu>g3Cd_vm5{ z5_-hhcq)$|!-UvH=im8SC=BJt-G@HCdCq~MNIVC|E6|dSn<}F)Cxw(e?!5wOCtqH( z0o6}dGp{m_#xqzTfb6d4FSz5LiD-&WiA#eTa3K}td%ZjCyOQOUtz!MNkmMaqSW@4G zevusDP9S52j-O>2)Y_EWM8S)p@NNvVf19tvj2(FnOlzucY)&YwUMyr7S*HcrvMiOAsR=0a>xOy*)!d?t@*bDi1 zLn~>_Vfsvxz9}Q_tyC($&r#|als|>xf0(!)Pt_%3l+ zL{Ny9W1t57E2FDFq8Hlmnbuo|*^UPzQVOBr58;1k-oqW2!t4E<`vl6<9L&?EA5@Aa zQS2z%t$YdRL~A|Ic!$Iy?}^1$`-f5^_~cI!`|YK`ZDW?hh)^oF!|<#-*65Q z!g!!fK-I(L$-gLQj|hkR^t+>Z{n%5kQ6e2`xA`Sn$1@>!9Ku}0ih1;E>eyeZ2KkR- zBIkYaTnOOlBdTQllm2^)3}`(CdX86ok?RtVfj2~CWB}~_;bv~G$bxuIO4jwLj?};O zX^avz{h;XDz75hgfr#CTN&gp!W1O-HKJfo}T~1{DRZE%%tsWcv>wPBtJ#V(jCcoP} zt^#3Y#{21(xQ}p$T%`K~i-1E;kI)C8B$vh6iRwIDEzQ8O+>mhGyvmcM7KIIq&eLTn zEu2vBhUntEVL+&}Q~ZOjy6^xoKF$~UXlZ%Bhp<|vQ>d}!h;xM6CzY%w?e?f^Lf=Q3 zJ;1z^yIn{XJ>fPlYZj(c@TVF2VShE_FIiq>i(mwt_M!(HsI83r8UYN2aquBl2B(5x z;`bD^o-6fRFHiXJrol9Ke}+#oopseHkkr;y%U{=%j>Ay99S1T9Iiq|ZqXE11{Gr|0 zQ0+-w^{4Pc!u(WuFSg*5H!ggKtj>|k(2&{+GlWbT`7wmK~psN>?~we8>pL*&tz-fVIX#L>vmg!YSXP-o4^ zGR7)EdNjCbyGC{d`@Os(K$H<_fPo;8MBVUPNw@c(jkbWCc^XH&vy=Ai28%_T!f8CYnnbq>5xczcA|e9`2jtMYkX7=r@z zE|=_^JC(Ta>Wd32Fl2_OgJ@%}y*4ESaPgCakyGF2NmL|O*PP(@Sa`_soN-;w#A}4h z6j%#45?5C%fyL!evc$pygPBJ%TF8W|(UtX-wPZC77cF^vKhy0JV)(Id%LynX4hk+4 z?-fwpZ^g%*<;aifHIYJ-NyvG~MY(YGLBcrH-jGu=N)pmtZs;2;h!FX-B>}y|JL2&$ zj~l0Pj2q}cJ=O}*?I#1WU)*Z?er7a52eg(%;|!23#xf5!qT-)m%;e!+!C2a4CzTf` z9e9HWbD&7uhv)Tng@YY94lB@8OXovt*KhcpM$-1m)%`9oh_MK?Je3JTSWH!mPMx|_ zy;(g1p;*3L5$54tkdzi(aM4ep)_@?B$ZUNML&>YJ#J(0!q|;gKQz)_Wpp7(Mg{KWQ zpOmK$X%~0C1J-mQSMSo@2C(dUI;h)cm_k7_5>)1@BIf4yi1@XaXCxlQN0J#xN~c?X zM2%=*uWh=!Fwj^3Di7NmVS$L~aH`{sFTODEVpdZ49NksEd#JRZ*{h!$nspFag+Ja2 z!8La7e5}ih#tfaE{TuzXd({{o%pb0A$0fPQUm^ij(@Vo<=PPi{$zF34{?wIbmAKf& z4qDz+I=dO3^Qd?FCb5L7A@OE{X{`8IIkV!6DK?|^e?nRF={+n=&AVc<%Qy#=1+IwW z*kfyoo^_d_dJim7RkxwrG`kbeF)>e?TEqr6=+36o% zKJ0Smpa%#N!1AT&d*06f0r-~5Wn1g`5dxzei7l5>lz`QUr?=w$cjTYn_LRoh;b5_C z9Jd1awoxmgM$-+JHHAE@Sr0f+_kN3N2?pYg-M#Ep?*xwx1xX*80Xn>Y6OJ43ov^j2 zGaGpcbtyVJFxh#Uq+$FwF&BYxc$j=jJD0=^1d>$$S_R}1B_zDZx>teBVRY0_sd zo2`uPlWUI~-*%+M`&qtlMm9Jd^J-J4BWn_8`*KY6mgQtf(l@2{3*z*lC@3jY;5j4> zp(_`Bo>rO6FI0QQ>{lb%5GKEQm3&BkkTWpe9_w{KGuvv315o*mOta>6ne6EN-i2`BsLbXIM3>{%i5y)rKRx<46QzH1 zT8H}?o*S9&Kq85o6}{Mdr6ViG+oF7Y252MKp~jk^T2ht))Qq6wY@2miZf=V0+hPw$ z#6u4K91d(!s*5BIQ#a=R8*CxQ)Vb}M`h9Zdl4!2-U0K6YqMnDMCV6OjWcb-S5{i{G zm3dCZ^UfpS16^V~utOuCQf7?INn()oxQY#0Sy2?h_lgM+yftb&GA*8?b2e}`Cw}8U zhg(!v2IUsRvffOE7bq9)gjw=FWj9CYK%CCnFAr0S?>BM`@F~! z1Cm#BK*sJ*)Pw&Dkao$xbQ9Xe*CTYH(r->4lB3PE(`<7{abFuJt^ZVu{sNiYu*oPB z`zWy^$9;l77-DU~z{OA|kEe=jXViWRV_N1&?akpCOG`X4uzepH4ylXN<>6s6&QGy; zr#4c0wv#=ob~#C-n7Y~4(>!h)U#_e$zeE}=x5W9W!A~x$1SWU#>KpLf%e=!g6KS)u z?G07xUentM3()tn%#p1OfBKO_3*DicW2wso=Vpb0N6J;0?v9-&yQFd=AgQFbfgDUB zgo2wnczpIQy#{qYQXWkKuLO%~adzyz<`~qvuXf*?#U!8Cd*PK`I}3$XVH|qa8^WACw!;;b-hAQO-^#I zQCLg_q;KD2x;qF-t+dbt9&F)7@^|B0?Sd2(E~o>`L{TlIF`5$t!NXOx?>bQ}GDCG&B`itTqB&x%+}x=;XCiRX&p~Y+7~%|j&An|if{oUasv5IA)`+z( z{}MTJ7=O<|{d++94M}Mv6plR(L})vv43G12L*lWpxO%MNezZY06AB$n<{bR}a$pMV z+PNrBmbp^Vd?N#raRcnl8q|(KDEY_>DJt2b2u$hzUaRq%LT-~`#mtZ_WP~$d%?bk& zg;N?zx{NBj<0(AD^ag+CRkOyiuVyT$rjJ0!#izDpc}EYU+3RfXG5qe!KgXEm4u5+A zd9)V8$9K&3e#RnVnqPE6h0HVJ(+~4h$dqdg?B=>@wa~j1RW~%@Ecuy79^O% zyydksOEBFJR%@zpJL)_@B(xZ1)$OF&D|!g4n?^g00-ftzJ!-K*1RhRa9ExkS zB6t&|6U|<~9nptO;fkHd8kp;j_`Ql8=+D3bao-*oI&?7?8DOPH+f!515%a;%l?GLC z?xam;nLqLM?nlrtrl2-xsDxMz$oUDNrTZc^vsh8)ERIDSaF7$9JC&EEe^QzTL*U90 ze!u?pT)T@vRAR7Y1$JC)c$bvp(`|F6sV+|dur(8_nAS;fhXNk^lVjNzZHt{@RrwtL zvqxjT$?LJ#R+xUGlL69HD7*>&(4EFYev?hYVFXxja#5LCPa+NeT@D>cAc8-WVNKA1 zf_uJEr?fdTZa@Zjs-GaYwRbP8d)mowaK%~BroUZ%C%2rxgd@%Zzi%d1YD{> zxARp8Q0hXI()~K9;p|tec@9Y;9O}pRd-9XAxAv_Xm+pst1&pBt=(a)P+u_5c6U+v< zkF&}Bg~Q(A1V}H`i4+I!bDWajN((WOOyq+v?&g;7@v834mR*23>M_#erf^?YfiXjI zZp-x1IBMI`8Ht}hWfgBFI7biMJ?FM_{`8X-wzdpsQyc#oZ0oAnkOM{|L5$Tu`FV+N z>002+{vaqzESmS0sgzVLevOD2uGLs$^c;N`!;=_fq7JU>=X=FElZa}yaeHbQ;nSuC z(6fqW*jyh!)nF~Mg(!9u;jkldSKsDdsnwOz#nvL@1iKfiLdF40v5wEC)+o8|w3WGz zhW|IJM*Pp7Xv6jCiPp}GNwG6}bwj@Ot)Y#9CS&c=Z#TS7+{B|GdGkN9K*eDY=p}R~)Jd9c5>Iy!6p{o+4Ce6RA{7 zS_EyTjnNq?HJxXafS0d!EedmuA{Ww4v!9(PYj0CeM=}4K_mC^YeS7sKK%Bo2%|T$? zi&8(NS+nw!b+!_o3Y)Rn>Jb>>CW?>#OBAzJ;^<`b|B3?FFHnanch@TC?xVk4czntT z&PibR?Bc3fJg!G+uQ}`Qdl1!Ir;j-hFUR3xThe6QVYTZVsLDBHZn`pOUpT^p!F~-Q z&j8Nr{7kh7_qO34BOKE8Es%@7J@k=7p?_(BK%8okNmPe6=ArcB2aIn-lam$oDNBI^ zrwO5ybrfe4Xq%#Ae-q_QrZ&_R*_{I1v35gOWSXd*Fdgs!DkgOW-P|gWrzXEtxl?ql zxJsV^f|U04n++JC?!5n7nE8ddZ(b3dRBs-#k%g*i;N?*d+^0zQe5#FGG|J~bVIw_B zvdzy2>Bt=d!~QwPLJ&~7kqPObp4%$$DBMtaP)zgd$-YXlH6GPqOro6lEfJe-pG1XexQql+fy>MoXRF*ow1*V%-5qwOdtf|4mU#=vbihTAG`~^1OnApogHW$2UJg zt#i0)Tr6oYr1~G31jd>R>JA@?0hf)7(POx9UZL9H(PZHgC%b_a!$=B1^tB5*Al?T} z|7=mI)!2F(=->+EaA_dF0V)A(mDPI3L|e0Ph0K#T`n)0qxwTxmN*cCI)5J!(+_BqS zNO%;mn9{8oA~6wXk9*F4S#_9xC*X1uh*{MhhVcP|vCU_%p=6Dm3K?#i#{`}5Zd-c4xg>_bH)G!i6{@Uy|$O5@ayZ;?)Xp2P^Pn0uR~ccg(#>ycM7QUm)PDQvMQ+q zzt}_GTup9$^O{zopSy_Jaal zoJPhq0mdpjiD))iTRKR+G|So@qScF`?HDkRo6C+*<1P?ExQ4BQCidY~hS`nt3`YfK*0_1@}YIGY| zn`2#!s{p_Gui5-U*|b0tm8smpxC^b%hl0`BkjWF+(mg}nz?@>Djx;~%XWxNBLGlgKX;A{;>M?6@+vt#1dGlYXNz3}F(}ET7V-`Vg zP}R;)#Al~y#{Q{XU=(*i-tomRu|n-cJBU8?uyQEEz1VtbI8g0Ubayi=H`%)*{E7kY zCBAu_*~e~e5jWuNp?^6 z<9x7p*Ai3290B7&09V%}7(Jn)iD(50OUjIf;kJLr#%y_iHdHj&(_kBBDzNK#CafajtzdS z-H;1x=GX-wqLW#(w$sCiVBx5Yr`THhmz%io^&e;tErHEas0o^S^F})S3nBJv2iQKi zi|8bLon3+5l{kYRP=*<_ zBcOwvnlV9+dj|{!o-wQOU0N3J8F4~XX)4I1zpD z3qxPph^9&?YxsXheAfvq{gIG0*`jv>6Lv90TJkdXN9h5e)pe+JbZ#j+QBsqjX97%* z5lBjWRA{Q3iXb=~siJB@D9(f+d@umzt=z7{;k#s+xU9`C3>8V^g3`6)#{2k~D#rkY zJ*U;QmuxuBj;6SVpBh7gW!2|D*1?jz`+GvZA0!SrU`|GNz73sM6)F<2`%+0bR9&gY z0(SE#m&6d4O`g_qd|cwCj?zh-$iZZjt>T1Jf$FPM2bT zu_O_D(5E-B8eeDr+J}eE%5iwjLDq$|EJfHaB+EHJ`0;NCQPvRTR!Z7@`a)l84Gy?~ z=QD`(^0?R2()$E`E!qGczoR+(5a*LC?AHn1fKZh{L&0VH=6-v-KgufZ0qqaF?;g-s zm*YT47IKem9KwF zXhVoOTFY%)*bVHX16ql;g=c4C{hd9bk?00mx6H^!4NQKqfHtScsQ6~$!{n&3Q-Z^H zcplNT&jgcii0M*Wi^`_2_`q+QBYy+ha!WswG6q5dY^$zJ$MFEr_cDngYE%dZUEVv> zMzo$|$x6-bKN+52DNC<2&IwU*MVWsSrLgTRd1kdZfF0OTtykjo<8u2hwI@~m`LJ|K zf25bu7U5@H7nZ23TV>h-lF9uf6#I{yD@RY9O7Y6c?(tY25In3>om8!0H^k}~36@+@D9{N26T(K_a zY=rF@L_I8*pxPS3d$bY2Wo!dH4R^*Ge}`0lr|~LfeVG z+~P5qZF_FO{Dk7uA(`p~*YowqQZ1E-sRtGT3+^US&rY5Cw(X?!Wo--fPtD@^h{Qqz z3^zw}#RwsqIa9e;hoLa@L+m%&Ml6+@v2et~OVU`tPl^~J%gg6mhDnCw_4z7{Q@lC9 zTU4R2P6ojQlWX9I1HO%d;+B!=@pratYB3N~b z%ou_80z~>7uD%{D2t||FRfLCS{gZwArIi>_DaVX;clS0K)+1ol`RD+RSg0(B4F4Ev4)Qdm{? zqNoA2h6ZKTl!$=|Appb_xRVndTGjhD&9%wu2~3)qe%RS$NfucRA2Kb!wb5%Q%$Fn7 z5%~AMr4fY6bk$AeD_-VoZM-r>m5o$W0THq(J_TD{e)WM@G`2!P=9I798VK3A%}sV4 zT%0(tjKkx!Nw6{gi-oEEPqS#@~sVrABRKG5H6o_W)3(*lA_ap>U;psR^PrX{%Ds{@2AoaM+rDT%YO z-RdCxK6OOTB4yYxNGU$x3ummEsN$mJ9Q=Ty>g57yOCY;=? zFuDrRVTL(`ZJ=L?UR9!zo=g>q5lkhS)D0Elr*qP?wiM1PE|%sD_U7wYSFW7cZ>vmV zem|pqU*vH09W^uuPRMFd@f^W4jbG;;^NbvA3UzgD4r&&5zVVrgKIwY$gU<97@9!WV zQhe2YGepU476eV%^3WQ8s`XHqp`$=-G`~pe)c3{WFQ=wctKZDTW-C?1 z$p^B`%gGWhMAc#=W{0^9aP8ok2#@8ISXxjLAN^`rdYZ-9hJ%tNNUX+_um|(+l`q2g z{t0h`rDND)t0H4_7~0x6e7e=3K+YG-*9_EYTe}?ixsf4<`6S0%&O;nz!uIW!i}ILS2b?=* z4=W!NR5r}i*1GG-K8cPmD)bsQo}N+`H8U|X=K=#V$aUlJrRBBt8G|!=l0|KKXAmLm z`sv|Aoiv36;&+d44~Ku}EQW|M16KGCi>IEecHsOt$L=FUOG@*zEE~IXU6QOUqGEe?sJB_MzLG-&9Y zF9iZx@MKUC@B{VzGbS!wB9G;!_`r23>vFh@M);p@3ekN=pMv2hF%FvvrNuyNEP!2Te{c zL(aAr40czp#RA84tkDH3mZnz1T;x3_?fqcZct^(O%fIzLvOp0Vw7M_-TCXY|>`*!# z_g|!uHkpeGQZN0vU=AJDvY3*2T5ixF2SSK;-SD<#)d`AQV& z0;H} LoVHpZ=W_sbB_C1GlME5&HI1J%l;zwermqwl0Bxo_Khl}p+blBwn_GWBGZ zYC1UWs`=wiVL!;Tr`k>};c3RezP)C8jgfJ@-iecG0|=0+8J9`Q5T`v0hDs$1CtJcm zw%D>Ae8y-AS0X8yyYBf^MiMqs_h@4Jnx+olF)iNhnUV}VM&pe8mJ4X(+xdnsv0Gdd z1(Hl(VW|<1JV6h~53kB+ccS4sYC?Ixe7 z3BIM2i$RW9aL>kWHI+GH#V>VNLu7YCtcl~KvJ%ob3l(Yzuh3?wcCDeo6{fZA4w4Q^ zXAH5Qkd`%CfBDHzdk_M7_K;WpyI3|fhlDt4yfNd8kwnFQK;B2*Y}(5hY~R-y*<4QX z7$PMT;(!EY5tsRy=hu5tY>coEYDP?bk&4ksimWx2~}oe zF{E8{avC+p?I;{)$)#>+csN1~DI&H_6p7u)pt6O_?PHh89QU5P?Sxw8BClgyi{lSB z;M>{Io?T&wTI1}KcbQ0a6{T$>4}qB&|0EIzLC=hoTFU{_hDP8nERi|z_R;R?At&h- zT`)7mXOgSt}g*`)1h2j&B!Tj>SS2Pf|7$Uo_YaZ*AG1)ud8 z)@6DbFuW2@)(&(jrQ<|#9-bgjesJ<7^Km*BOGWa4&wQqStB$U{Kh>7w2ArYPGOmz( ziwkO)K-c*ir&&o=U{Fc%?5@V22wDKcsG>-{5uH5M3(L5u;9Q(t>{c+XHtFRmSbMAk zw?*5WnCD{t003`eTw0ulkoQPHu~!ivZjF`JOcoq!k6vjHoB=USDjs}aobV7ft^o_1ZH=($dreI z+SF!!OiH`;uS?X?pinDCBanEM7ZgNyS`l%z1mYtNyGUA48-1_ZADcjepn6*Um5U=_XQ^L=)SxPBgcX3 z|Fw#vXwC9uN)mL0Cnuf<$pA}P-P80DT1vwfwfFa(iQZ=os{bwK@~Xoux>1>2!;zC2 z<~ zZhM-cJM*FD_m|p5JhqZ(?>hwMBt}N$n$}+=w;w{MuqAaVOEvO)YnVQ0GaE$8B8P@s7(t5AoLQ z_$>KO+{pD^My-*|^cT9u>j68o-w zG{y3s0$dZH{)=(zNoz=-w_*LcwhQvnHhP234TW3faSqX7pT-jp3T~KKW;=>2Arka% zrQqnoE;~}*^_;S?cZ#4*IBo}jdrM1ubtYIy`S+DvuLc4)&3VQw*j@75IBo|N>SP;G zvF9dn$G3zY!kf}%`;(^3mTyrPNuj{kf6i9^4^ixr(;}}k0hwqPe}1`Q8%-mC-~j`YE`W8HO* zKDt?x-C%GhK>lU#UQ^+Sk|Sg1CSaZV^arRzUCrsjP1E z-m>R?_8S{S!+aVmL(MG77a!bN31$&tbnF6wds0kPS?SLVc0F@BF8eDXVMLarFUA+* zi(~5E1tb?uGld;b$b>PdRXuViVcHqcuEn^1kDlG5B-6U#cFzrP^b|#RPBYPWfpiQ) zw)DWcB+s{q;WL{Q&@u|M^qq5dQ)Dv(g6tklR@KrC`!h)C0RUMARTm4Kj?BwoD8Xb* zDJO{!3Fy~&I*Dqz5#TZst-Y_yRFh`P|L8|8Gz;U%`cwz+GoXAvb+o3l$Syk=`@$#@ zR`NN*QLzCa0vyfP?K*luM30w6;;_WW-otFv(5Ur7m6V(WOv{$?jbHbDW-;}FTwzI4mgk)o(Dd95IL zeu&PgA3U>{By&qCG0H!6=@F?O_722Vf`gm$p3tg1JTUh7mS@!#04qO=`Y6W%ka~2S zr#PH>ht`BRrdg7FN%I{>TnO_RJa?UuYM184SRlA1@TkZxW9{jas`_UuRx=|EyU9CBR zbeOhf1|VdTG^tCFOf~WL1>FB( zh?zi){jf2LXR?J(L(Em0v~nl}mW`#AB;Iv0zZ`EvZt-U34j9f^Gj!rWGV`9+{v(@$ zRX@s`GF`hFKLB(IEdQA7&?W(`uD)w)=Q<&S zJms&)$do6{9qfa^#Z9aHpa(B5k)=#^ty|tTEsR!O88dywEwB?ZXd*Xh2pAliieoIY zGY3-QtoFWbPkOaI za&-Cy?1=l{e&?a#ybv(D+SF+3gF!L(q4~a#ma$OP7OH{*lZ`)1#a%7tJCs`DSHmt~MKXHJacR(qY zuxN2iImuU4F8241d=^U`YiHaLF$0feVNf!Kr{4C;e}@j7!$?io4nYtJLsNKM{7LEm z6-jzp7iuRmP0e}tY$|KHLaeD=LuJiu`YOi0U@aPtp!G{@bHaL$o~#(SU8M zIa%W$eY`6qewA`WG=%mEL0;E7``w5(#ddsuIQ2k71=VpCX!Dq94^>VW;z9-bf!wkD zEa7X&60I9eoc}wJ594i%*jE=Gi`R!REKu=HLIR5n%(UgXc>Q&}S!bMuZq43LZy5Ei zsMVxNW%;?Pj({qks%83V+=xWVflTgSlQVnz|2PF26}bp)4L~$KNQPv{Xvm^V*T&`d zBehin&=YBoPwxqG=Cg#=mI2;k$f`$K5vo|$Nb+qn4b(XL-{3tfd^#!<*k3(#DhQd- z3mcnsv*&ho$ftd8&#N9Xz~KUPrXFy2<1b;bKZ3#LZ=Om=wYFfND(5IkGC{L9)EQ;OG%YpP(iSR z15{~W-YL1A!|5CjM#eVSRJuE*RDRu>K}zuH zMB{>q%|zpo&o&T+S>|Yd9r@w|woxgV;R9(J*!cHpcXc>Sg^Z&XPt3?06ioai!KuZ` zZ9GL-2h4PGt!35AM9$5>YosSO7`aY0?*N!R>v2j>`wG^(L} zH1(|Ys&O}u58P?dhcO;8bhQkn&o5})^V5QZho?qf;{D_&qQwPVtxfS##uqeS(-Phfrke%0N!TgY@`-X@d2 zk4~U`Q*CQZB)6_TD8B5Up$l`%TbM};_TH{rYlVASV2Y9AvPTX54MwD#=cM)tN5`5S zmcf7fczSydI~=C63n+BY|AE1ObF+6~vZpbLV8b&`{imjX96dL^i{ML)`Px3IDO*dLvH(>Z1D` z)6*J|aJ&Ng{`35?ds6E3gnyMCFNzZ%P}BEdCL}2u4q*aTQIfR9@un1Z?ib0L_KLFc oUFSd2BL=wZTQS@Zi8LJrJVvNeM`a(3L|jF0THz)~toWjSD#9F2yZ`_I literal 0 HcmV?d00001 diff --git a/terraform/implementations/aws/infra/tf-plan.gpg b/terraform/implementations/aws/infra/tf-plan.gpg index c30679964f792da07451bf81b2caaf13d5ed5544..8eb2d1bda9db8ff8dbf17cf7b47be7e317ff6e13 100644 GIT binary patch literal 61233 zcmV(hK={9m4Fm}T3Y5mE(Xi02U;ono008eC0gg2ms-J216BdF*7{6)2Ymf_>9!T7G z!1*E3uj+?%>*3#{mZ7eAy|#$EG;_$=@42-)lEqDwu7zquQFQ>DV&_bo>(-7(Zl!LQ zc}}IO2w+j9f)D@SBnKa=$OxPlHrd+u*K;e)%xPsen$r=*HUsq5D9)c+<;bk{VMhZV z9}kPw9&P)^plvae72W>k5;HN@9-DlG&Pt;~=Y>Pg2L8R-PrWZQYJ{g7sL!4`q}Yab zJ4gDgCLCt8b4V3A1Lf4N2r(r}sm!d#7ejjuu{`3FSDbUz zfHkQQCs~b!OoMU%0;fAM8W`_tK-_(lX)Kku-|*NBoccv*73%9J&OVF9$maKeiS8L< zpd!)ccpmRCR^lv}i2*wVG38S%C_iek&3BkapjR!FPj7pKvG%UVsjPnZDzp-Nalx7% zZL*K?pB$jkEz|Vr%Of%atj%y$(q;R6d8@LIm_?b=*CB!`tPY1k<;lhB5=Wqs*vm@G z$tKoN2*MFVOKZoB7^;@Z1GpgJNd;7ny}yMqHa%}XUxt1P9gA5M1pR!xTe>RH(k(@# z!5$Tq@|-7hS3PIPbtH$f8Ild7-vluMUuh=;2v5&A3&x1oU6xSYff8STVM}7amEUuv zY9gUyOEvl9sqpLTKfjT>*bGy>e^?8h)^Tvu*6T zH89wC1Vy0ApRfTnow42}x-@OewoH~vg?rrVXdTo>?w6S8?bLzg8~>DIy6X^O$e2N5 zazm;8RLCD6Bek z8*�B;TEGL>mL`v+~9mWyGgR4sdoTqkJJNy0XF~8@O4GVF&cOMcxa2%ZDI%I~O4_ z?-T760k^SHLq)FbuZIcVHrBhHksh43sJ639N7Jz%gh^dh<5@k@-S2vbI>y+>|9)iv z8AmuEhI>Ge#~WdE_$mK=UH@>MEz2><%cJ@v{(6y8(>gx0%~>D-jz8vvo8Y-=kkGVj zM!!64DhMaNx8M;rtyWtA1lh$VQ$5iTM`6^4D)v41+DM-;AAX@FW6^r0-lg7*;GQz zZk}>{(v9bqMk-X(ko<&Yv}%UPn3b$aduJZmGCxAyx0CADm6(PCI>RVqu-Ba7@z5#U zWIQ+prbs?4plsLl9C`I9H^w90$XN6v`xwpD~83Fx7WwH?oSuK5?uD(1&IDSb~tQ&gWrAkntpLCAS9-p1y zpsoL`zV?{ZCZ35CJTWFNwQS*e!RE%@%Tx=4GEaum8fiFr$9Z0sx)cZ)tn2<&`#4A! zc*+qlqX5YDbDn`Ek>Qj#WfrKlKr&9q-6PJbF(c!4P}V;`90~DIlGoZT9lMjfTY7{Wq&&p|<&Az{xk;dDyV*`U14Dz~qB}wL+8Q(yb zXOksum#*J`^s8fH?(P%<L-&oNl%g}aR>O@>W~L?V)xPMLBUIt$8Qr8aXI zj0sV49cr`3R*X+Tw3yEYGAGKf?CJwpfy|NEKJu0ES?ciMCWm}k*$$`NaI0&U)4`J+ zWyGnDs1#o)Z_Nr%(IeoWB|^}5KxaAVeapfIbuB}~2K;ptx1sRa&BX zIHdV54-TNzzUgYI9JvgxQQeK(p{VfhrF7F_SLCPyNKnvt;~=A6QI!$c2TntKs2sA% z>t-ioh(RJb?xw%_^RWU=<#Cp`o?{dqc=pw22|RCb02Gff%@M1ShImQEI!f5jrkvm*=%UtDi4)~6peIZV<9aUPY+E3BLP z1yjsWQLG;)|J3eMd~$x_%u!6d@2T%s!C5Rrr?%_F=tN=LJSwbA@*oR=HjBoo!76?$ zGz0ZzIK1$pZ9qJ+n?L;QqT~d#%g#3Yxe6bUc@(bhKP!WodlKiL#qn&gh~YnE^=8{0 z|79*W&vVtHbx&({8|>yF!vb|7b`UP<-?6@ZUAx+DsEn?w%eRZmV)J~+*tXN_g4jYi z;6h{xys%>iTecW8uU^bW^rcW&8q;sUkC(d&X_Bhju>Hqvig4>hidD&B>W?@xcQj{d*-o)75S2d9iWS;YC_H# zVNGee^H7-n+!(y)ACN(~vDBP~HI9K7#e%81`NP-&q~bGYw8Isgpj;Qc=}s_XxEA^2+|e^ba$A z7Dzl3#CqhD>Nw`{*a`+3M`I?=hZsD}JZ3#a;b^8PK@t{q?!B%smN>Q1xkkZ2M7^=s zqj0!bnf|KyQ-IV*c}2#JWac`|qu$t!_+r)8O&u6|07%K>7m=s2CDr8}o@&E0Kq9dp zlgZgbs?!8?3ZnIMbEWAi}INDJUWk(lQ{B%maU1_dviwcr*3D1vXH5Jy-dspvUoP^d<=8c@R2d%aEue zOpMdF8Z2FCT-W8lsZ4*b{^3dJ7e}5JA|_2dD$@eQRrv!aSok;85Im1YTLkL4O%p%ZV@P#*M5!CY;mH zK>(Uj)9rLN%*YHr{HhyW*CefcQuf$WuMbfqE_PvDdcS?memVF4tLx=B{vXys0{Ul( zX&8pWzs_{3<156*o@R(0|8OwdBKs!;HKfM~j0fSvwq*290G)QPFO6n0+DOyY&168w zkLdbegZAK-vS~R4?%PMtolXq9T01hUXc7Ps4PY*z3PlwU2{%DE;`pJmf&*aK2$(eu zRwm#ph$_LOo!VV(80KGRGU+yZNfwIbGUSoR>cc#;{6j%dOVvY(}w2mpZL)+an(Mh#LKh=z;XuSds=v4It-I3*U5-Iut<|EYOhp;vl_R>=48RE0Z-u+&d_-31yzj760v)Z@dg476RY@x zs$4l6uLSGRFSFZIM4+37+hBZZ0k)?aF9%UU#tJb=yDC3-skR+t}%E*BPI zLGDq~o1xa90Bw^{rn{@a^mxm@RLFtgaoZd3M2H(DX3Eq@f;x19WW4~3EKNQ z)X{^WE-tC{uSv^gr|(Ra(H%W`hS929i7q94vybD!^Rk!f=%$+ki|TG`;4Bc=dr z0wZpwy$wJkQwc3$3Xmx?G@AG3xFVq4Jdh}!iT8qj3X+(-m{oiswr>p^D9KU_=WfO2 z6RXLycx6t+a{UrGw66M#Xer!0Y%`C|K6Ur)^VorW@G<8~_vP~TB!bAlbM3O5ytoe( z-CrniW0v~g-=ucDCsbm7%4o|PRw*Bx4z)zJ5BU)@Z13)Jy?$E^eWL1=gJtNVZ-JF8 z$)psxzQ^a$JUH8H6)rMqZfxy{2hsv>#fX*QXJ3uNmcdqZZiF4%SNggr+v?jwM;QI3 z+1b@y&4%Fxz_p4Y*L%uW43Gl=#jc*4n>bdKD6AvPYCXo|N)G)_b}uABo?08$S`DSE z*PhY`1Wf83FQ1SevSh`g>BcGp^F!s%dy7^aYE3405v9azQYvJULKnaJF(-Gm8Fy}w zV}*Wt1;GxF(5h3eS-?hgDwF<`#X%?%wAxq4-r+#OkJWxl6Z3!)IC*UN{GM!s&7ero5$|LEnO9~JcE#rYVRV8UaV;7gemcdgyLGjI zwOF&p;qz!DDjXZe6%p2UZgun|UL5Rfdl7b;z97ok;nrFAv)d;NZ{9mrsMO-XD7wF} z`7mGt`>ctUuE;*&dWQLN!a-MI%Q4YeSIQZtOh1 z)Jf}-(okNxi1U_xAw$*v(2>j_RRWj_YI-y6d_bgh#9EJM zjg8KgWW{Q8ix;L;8wxUNIzhKEVU=c1zk&hmZ{qhTJpiOuh-*D&+d+OBaSgt}I;#kY zB;2ct1cpg8Wq^McQ@A1zj+ULp)KlyFIK09rZ0_9>G&6_rFJ2N+5XjbsCZH z>ZEY}#$y*FbXIe3CiO{}>js2C{h&JSmRVZ8j1Dn(j_OJ6e!oQ7O>_0KcO9S?*>@Ne zTkEagls@NMIxYC&6D!t7mPl%Xss7+~YfTYWOhc_{;g8W{((Q`gyL?s+@S80bx4z(+H!NG76 zxz#3^mo$%hQLFqQ*|S84vX-&vk!5_q3V)L~-7y1jW{?)Kra2 zl~(c_iNy==sY$<|I2K8_N09){C&In(1`n>dd7N#U5COt$NE)A3#H$pI>qgTt;Ngua z_9_WI+Mlf2tQ5R11D0B4@~t`C^N}CZPP|#eg@zz0b#D08rg;MKie^gj{{p-ydZ;)- zQOY>9Ief()sIwa zbP(Snzx}KXoy1p6cW?`3p^MCEjpS7GrGx=LtqoW>wtEz6Vr`q{u`vNcL+wS=CbUV5 z++1FWEMcc&5F6i-@l~0UAsLuUqt1h;Vo@*vcIjG@{dIB;nRuAkuuAK~CNBV(8R=|9 z;&{S4DU%J6M{%`Dpa^3|@4D=r467*IeGiv_V7YlsuKiR@prOGrJ}**=bwv;)0Vlv~ zHsC!#y&w&Gwu@#Sbyxs5u{VoT!};Ki8bzLSnChKo{S_R;bklJlR}{^}7Po`h1`g{0 zgprX05Mbv@vBRHv-Y|l>LnDd+0RupA3*71l7q<_8q}RYFM<{_J3l<-XGDFyG(?({b zt zex@Pj%7livq5NL*bXEWgaF`Om`*i z-S(eYL7yznAkSyJD5+?ALfNGUWAul!z1>}@tM7j$E9_MhU8HoJA?Cqr?F*XSrfzRS zQ4Z0c^xORz@?RkF3tM1vml+9|EB=tC{I_o5w)j9dD8OjUF^-t9&TrGTyPisViH8)b z9U?!-9L_F2V2n3kH{~7O00C2D%gpp?_F8wAq#rWiYnKUf12-tvq9QIqd?`UOJg#c;YS7ZVzY=5*2GVF#5MYQ2=3_M4&?}g<-B?0*@Kmsn?{ox~Me=7Dk)zE? zuXE;|-A56;IeZ6O)QoW*3(afGBZhghYdlxk1@)r{E)D~kcFj>lAi>RM>&RuLYRiK@ z5r{XZW&D5=t1SbTLvM+JAg>N$09R(V6AeG}O;hb8@h#XJYyF3A2L7)e(*G`W(zB9u zec`mYdJELoK_~pqKi_t?>;_5p)ffke(Mi~|Z%csAk?T7ckw=q}^$Z>ipr_L!qoXAP z2W1X;E5jn{*4ZN%2N44+-*)FkHf=F7(sp%BK%tcLBSIOhv9|r0! z?yY}dpNvP_G$qQdRKftSuEyS1;fEU?COgEDX6N-8YL8$o<$m|-)N`o;-y+n-qGS;% zJSBA;cO$F{dNb0`Db&u|@PvI2@@~|>lPV5>5fh|vD$PDe=85d51peAj`d{{A9^m!r zbNqV<9X&hPeA{xp`cu&aPZuFDMxg(JLy!A7AdQ8zp*n;2Bl-Gp!{Zb_owAV^bG78?xZne6cry_JGlT1ZcwzjKNB=62)C%L^XxLiPI@H(O^(X~3da2!u9`?qY{q$Qq0iCM6myy{#3ucNX$M}#$apK;J$ z5%3vveRkCRP_e`5sce9_gq|!+=X5nW<=-r8pLheK!g_A80w1CbnIHP^W=09XWNDWb zWAb>BG}NI@?ahBFS#!3ye_zv&KSGx{bb-KR2A07aS{6(psySK?n8(VFN?chhsg_Ul zG_><8A#d7?lYDhz?r*lDtfhoY(KBMB6j{!o-D(!H3dr0OuIl^_7SY(~WbfKMU_WZHjgP`1W=9haBwQ zkBOw>v}L>I|mejgh&WNC1$VO3(Dd}B41Gf+*NVRkCntkLpgeA|_h2pQu0 zyrt%?_P39^O9*nU9kx=yeL(n`cKT!oOOV^Pyf=Y?cbF?Ch{>Qrev?Yep&&vOdw8vj zyK1Npz#(evqKQ2r`U1f=glfJ%+eHLb^CU(qOfREnwr?Abgst0jT#d``K9aNF2VZW?I?zY%m|i zhL|=9DLAKS5M}XuV7o6%iyYB`RW7_Hu7=8Vyu}0Dz$1uS75J+zKbGl**Kol>E#HuC zef3Qp7q_c@GkhYUx&F~KsP#-Qx3sMwUJo<}t+VuLH8OfjfL!!Mvm9r4jR2qCQOdgw z9W2gI^GS;fRg#YHx@>R8cXnm1EJAPb8;o?RwcAR9+)8?`_lt9ALmV}?G(05IBpdg$ zU~FXmtFu6uIj6sZ=A(OD^_RH;NxS~F=eo_L;{tUxg7r*y%1=@- zl}oQlZei5g2NNHcoH|zHmk%-pt~x{dbOGC{Z?+}0pb?giq2GK}6ZA-(9k*)Tc|@e%@5u8{lO zJ=Oz~9O!wQQ%%n7N`W=nk^8A0zkx!#;U1rj`Nc>{xlnzhg&LX?af)i_0pY%Kc@ai< zx}kq}G3rEbe86vqmt#FS8#u(kp>$B+48~?}Z^PXq+<3sy?A{BU8H+27*0dw`mrKw# z51ACpIC3)M&WWL*l1ggC-Hf2Zd64L-J!uzLx$^ssWh?>JH_k$QYg8~BsEROiK1Ql4 zVKBN+jS5|cRQvDV0B56{hHTI)7xp*Mn+B4Jh;YE0uFwWfs4J@6*bhvwh9uw&d|VOV z;jb-zz#t2ZVH)kH)Huq1u@h_{2)Sl%QQQaL;vGwjE$}w1xaS+|;>TUv42YB!((wJp zq3mQ`W}6KBSS|~a_d7ceK$}=jfAs`huthYgu_ZEek1?$woa;hF_K^wVRW7oAzYR}- z3ZEcVh*m}qpX||^>(cE8?dqBN~{*zc7AS?0D$u*CM0|Dg( z$!%f^-I}84XCh_Qbr>2Y3(@hCdR2&66|)bn+dL8HfyP)mz8mdz?#*Lv%*PUHeBJ9= zgIi7)vU~p1q`>OtiO;%xr_00u+Islxs z37;^N!tq9o)JOO178)=RPFZTZ`U4K!VBh7WiR3NL#5Pwh#HGh1bXt>=GS3y@QV4?p z*kk7R5H7OTWx<<1wEA`;-ZCMf#8Di^Js$Du?yK>-aBlA`82L6ML!2GDXVO%U)jc9| z&0ca%7n1K6+%wY}_spn-%S2f>(ra~fB9t>z3>)j5A6KjV?5-qbUA6LoSYSn^^@eIgS{%bI9~NfVY;zVpXR0 zu9ZScp6$;EYo;rL0V|KXTuF*?z<&PkUhp)}DIe6sR+Wl9vQAlndp)dEQYZI*e~r+& zvo~opNZ=1vUU8<*Q5&N#j1mhwlsGY`U@|?4$BJW`e*yVbBSk6ZlfHQyTXpgT1mq%9 z_Z6o!D&jXQAs1_lY@8@nNV%dpi>Y~K>`41x@z7VjQeG5MDMQpO8|dpt#;^`XQRAySlv$2)A$f=Fi-1b;n6aTMK$UHVZ|#s zTH7xH*%NvD%^_l^eds68mnJon>G%ISaTQ%taC;3C3mRVVx8<7yQVAJPqev5^99_r zS?evk?1p%7n(jM=d+=&L_;PXQIWh~x9yxjeM2)Qd?tCV5qKUj0xU%v!Nd~!a%cZ}$HjXOIZPf^99^)~$`NH!#+;Wx*zoA}T zXqK&a{kdM;Co3J(Y~d#NR|$H7?Wt=H7%OOyA?y?ko-ziC>}cFSci|Ak!)3L#q@nDj z`;Z4cb494DtOTKAzHZ?EaPp|V<(h1>jHkf+AE?$>bEwaT>}#*xo6{9q0zjDQ;1~ku zsny`LMfiGlE!y8_V-gI$ixA2??>|ho*9Mw2x|3Gjs(6h0)*%HRw2~B7N99`$uqs+HoMkf)HTuh{|GOb-s7!tsyhz$G zOJNS$m*?e#Q$|rgw2Qh{F{IR*3B3jDBZWLLFvTWF5QcP6N9Nf~_QkfRRcqkhO)x1k zZSpf-j1F3+v*Eb~kK_HKvNlDzTae#$lRRnC(yd^BQ6XNJB`c*RlKc7bm0^v{Zr5+NFz^GN1D)aQXDw1k{U6`xMY z`o$bQ#d@>AfQtEJ#;QDh(1&bMf&%0;aV|Wwkl%EjA zQHa^|ughnUtWIirB;VDzuN*9wMyaS)(7CLGx`+jf2h?#wvc}=+*O1o7nh0SrwcgRRN63dF5U@OzHh-hJB`~QVm956E+ z+m7Dlw=Nt}FPB(I%nG^~Z2Cv6V|z^D>|*ab_E0^KS9BPzrGLycJkb6)C7I&mcQgYO zLk`E%gG=Y0%pa(8dBnHA#6Q=~b(=m|^N;o%r79%kXC>xx*rs+3-oNe6V(6|ePDvkR zn5v>{+qDxq+eO5k*ISFGp4y3L6P}36gAafWS4WSU2L`FEs_G5+C#g=I{u~KljP+GJ zH1>cjJbMe2-v*KN2bOOPdm6N^q;%ULlm`D7Bn#dVMZ(W&F;Oi)vTY3n)re3p8N0^$ z#y@X#2m=}Hz6+|vZdYKM@I=VJ9Ydka?^HM0H=>ncW!xX6z>H1fE_B{`F`OU)yLn|N z&p0A_LdnikD&3(ER#LR%X#tj2TL-;g$Q8`re7dG zt(1_EzhczyMd7Csr`=nnw9UN}1G#1Esn#Au#sA?NI~Twa%o`Ob>`ADqi=eUf-$}rl6(@J@*51)ChJwb z2OV0+t5eV6Ob}IUz8q$Mjst;M+K%<|?tyJGf)4k8TJ&I)YKLh>R`G0bpVS`Vs}@XB zTb$|M-f21Tnn79OZ=Oh`sc11}>a4mX;XzQx7!kig)*tOOJE0q#;qD7A-gW~X6<^V~ z^*(tOkkUKiYNt@l9EwlIX1_f8&+6;Wa>~$a=0+M3qE47tZ^OcdlL>N=gakw62rtdZ zdX?;tYMH+@5NEnAh_Gd(L-KH(f(I^o>VX{^hAwPzZ(j%(vef;1miq}Vx64<)%PBx7 zh=@Wy9v6^%DXG;}|6{&$l?T#7*k!+nel|UqmGzu`f!gO=G3Z6d%tN4Mu0dV(s_fV< zbA#)@-y+A#*6mAqOWcH#rQsZ+*FaIcU$#`ot^5 zQM|%ivTQ2TZ<$c0{3k$U;Db{6o8&^(1L(jJAjertX~d|Th7F)1)i{!IEBk`yGDw(o zP6095TczY>>{b!E>bI`fk8u#nXOT(MlFxrwuk*rA& z%QXtOjR&Ywpo1<_w-PV+QFmtUdL0Vf%8Z`D%MPNg>xC`*&y$EUb&NZ?R(n4H7U(DZ-F^QitA=#l-iqu)4E(u|8(b zC_{yXuQ!5zevbowCdA85enuvNl2Re0rY5K{%-wiDbxMxKfA)FS{P>W(%P>NQa~dw1x4$n^G8d^GwPj zV^#zG+GZ5*T{zK1Zf>PY6Y`|}YbYL7t4Hkyonw_#4 z-+Og_xj7IUv|(&IhG%6VrZ-(D{J|5fyRBUc!UlT`=y<|wdJ~e;UCMVJlFpQX)&|GH zfbTT#MRSAk|LMdZu08s+1kg>M@_yU?6qoviaG{~}+B8WN#Q7 z#4{GOG@It|G4-htqcV+7laDy~Sm)xqQP0B-nKmzX{7ugr(bs=oBEqAYVz5=ga-t=4ptzuOtU?9E z-Wmp(L z2NLFjQ^HLKV-{lK6cbH1k+r^b9tACF_9Y+;;ehx~REPndb+wr7Ty;amXy(V^QqLF~ z*e-7Gx*K&OPTju)ln=dOp=Sr(w>litl)S$j9cKWU!VoXpeG_n3&*0HL2mkk7zbD;z1CK#09%Np6O{b%Ysw2vJOGreYg>&sraZ+Qm;;q zjB-w!0UnV#9WsDK)B3up6>O=_La$ozc+?{tUN@MCY@Vry02v7w}I-kuJ z);O|4_|zUYp6eC!AW;Fr{y(bYnu4A92~g74r5kqm*!Cq1pM`qqq>_Br2McSYEtX#+oIIS%&!_~sx;w?&X2Dzk|M;7G&BqJR~dYuQq} zr}9he5B?;u4jC_8c^j$ufUPT0Yv1N#=d%8AlohHKc{qMyu)>~vGQw{cry;Vq`UnP0 zA#~vu{yxePzzV)aiJ}s2CE)a*dm2xcN$q05aw{@t;zpHTj0$7K74G1djJZ1TStYdR ze z+$Pmmh<9WSd43R7%aI$`Ev2Exv0IKR9eOz;s-oo=)jh&%j#$!_;ZB!pH6n=558`Fj zWA^F9KT`<7M>PSoNmi~_jl6xnaq#*ktS*0us~6=>l>qibgjdtQ_rQo0O)M+l9{8iO z>e~nTcG>vOzjEIC8hi#0H$4f zSO0JwLa@n2`j(py*p4P{w8Vkt8+lAgDLPL7W)>oH8~Vvnxk z4_j6RiRTp#Ok6x-)NGQ^tVcUCx`%ZiocXGoPK-Nk)t+KXIuNd~9h1(VUD|ezDaQuA zi6$oHtS^{sI(e(Ulc4z^ctEr?P)B)QTf{DR>JehojLRW`kw&{~s6)n>E$&c4$Ah6x z1MgBL@?AT8h0x74zRUMFuXKnKnzxvp^k=%Y`BqID?uY``J|s|_P4E0!IO7R9bd4={ z`PaWHGIP_4jnekA!9(8Sp$calD;j8Y>`nxHJ zm<8qkmxfJSpAuvc8Biu*2oM0?uMLwU?Z?Q3Nb9qN563B_Ku?6)c~~O-hyCc41E3cW2luV26SMm0-2@mIV zO7jc_8Z1P#*8CKNYh$Rv7JRbtBE6gI zNy)Pj{PL>UH)gg$GRS<|sGb}lh7IeE0Qs+UDnV3uKmM>qtOF*Iu12aD_`!8~>F99` z+N}*cxJr*#@jubB%v;^(g81)%5?MVagR|+iS~rzzB)hB;9q-2mo9gJWSHZxlyyc4&~@yGxKvqWIUrdip-b%vboA`&FRx ze&R6R5KceXffyg{Qpzzv329T>dIP(WbZsbrZ=-a7Owy%=vPHZ)OxK1ZdyD649AS9L z4QnxoOI{qp5+7B_b~GmQFY;M&D`GT$1L3UXUU~AV0I4MbiK@+Z*)ZpHk-)4R;6GF7 z3qVOTTN%8hkq3mM3s?Z)>jHXa#68>}sL>9do{$`bJ=ldnyquVK;^Ov9bijl3;Uy7G-P?Ainvs_+JF*YlP#fLQ{a0qK8@2h z#@|YvsiP7{SqG7uo%v!g7zO(_XVC7^v+9n=aJ?Nws=}#i?YC1u5N)vF>VkFkp|%-( zLc-)7K~&E7)M-ZL?l6XvI^$(1o=HH5Xlk7Tc*UKAc?pfSa$GSmU+vJ0+%MH@vP$4-Xw6#@#& z0F4$Di5L&53!B1Mp2sMSKl{dsD-IJIcv*2g1@x@wfsB=97r(=xSG8?TYBAXrOOZEc zb^)H~A_7u0eY>OO;){Y#Z7xWthLpHyQ!-?JppQC_d)11{XQ?lH!S?1dhszO)oCu#X zZ_}W%AH4*o?F`x+QPT}8KYrB#TN|ckh(igvM=F?l!1h*1j@Max3y`ip z$O7XN6tKG~1NrsXh$|>b8{nFn{p2wlr8Zx4XvTc?+g@ZFmHtzh6ei9E)-r3dhtrhF zcP5u>kU2U{g08~{Ojl*y#i`GnE1VADXCSPm-3&Zi;OL~vd>VSu9(EX9@XaV>_P_4f z&S+1pI@^cG_m)&vm#HyOd@&6_zAn_WM+gB;D;_@jtN5?E;4fxJ$-T53qfYqQVpIPG zF8k>ME0Qnw6$(?lzT%UmI;-j|S+W(&p4d5agHUR&=oRU>U+U51HY^DYQZLI|pIU+( zc4NrS%e-U^sHdZ7?k61VIqb#Y;y>BOgwxfDA-Gyn>`CiAT|AzQnvNky;w@9ok7H>D z6fSz_ToxiF;$@V~ChinCpRS#t)ndQ<{Hol5fNGS_#yEL+5G699sX|fsVLAUMW(7)W zM$`Tyr;~VhQpU}n8o%dq714TkXw-YRQE)il!gba!%uZOtjixxVZ?5DxiMQEk2YX^K z@xK{&0%J2W3+E2YXD`v6GWML- z-N?NA`cxV>n=iNka~GbD#%IF(5``Uc{=(R~jm?oS;`!VIo*QbTGe9c*^$adtn!B(U zV=%X(fYy;7BubMEG3xg=uc(PNN(^*qohaCsRY%xuJ#T>@lly`Gu zSxbT=g%RO0pjXh%6x$gJQ)i+7yn+sJS5e(|Rc+IK77eUT+Pt5OKWg+yl!R8wcaJW~ zJ@3H3f*_gAc|is4+LeD-`}4HByD{0(f8(smLE}Fje}R4}V10pW=X3@YvnBal9g+VA z!c$#?QD&7jl*qUu@)7ta~rn<|_b-$)R%Q^03YeM&nb4D|x+IP#_iSgJ;>&i_&@ zAM8Z?of^9D2#|Wj;HJ&&SjzMjBdwG^95R>;zJ|h9R~XgJL}%e_=q^Z`|96JKVd z%T0fsJdFl0L88O0wr(BNHe{gnZx9m>!H}fT3ll9kFg-Ba)=kkL;fafz%I7^SbiSJb z<}x9WtFKYAZ_1Cvtej02E_&lZ9Q2rJfDoh12zY9)1WbFlVF)wQ4nx(P##7+ub1y;3 z%E}WmaGV2DiKJ0GB=Y}%lur-Z0B|=26|wl?(vK=a$L_A71W!mLjY@9g?*G|{;wp_% z_^*ObX!$6H$_QLy!19OrW8tDRicn*u3==V-QDdU4H0tm_1?dnVRU{y&D!%cmM?xn< znEV4OJ_SwRr|HlpFyXt@Af+NszrD2?Y0dB=mu1co@&XP+(}P+(4hXNEHrB+->%iad zp2qwV$*y5XYbGvrXg2U1lT_@H5MsOgy<^&}pZger+!U}zyZ}4=b{b$9BO`oKcFTabm`Tu^Cb2J zu7gGo@K_Sx0?q&l6XS^IO%280rq6%t9UK;q+52c{Jt8ib z%JRyO#K zd_1&9GrEg7#JEU`a3UMN*t7NMfUszXXV*R%NIpI z!a=xo|K zE%0@6flFnV#P(W1dC^o-xEsCif;U$-@)>O!3aT_P6$tZpo;l#5nTf*1kaYwX&cx(?;Z6ct+!Wl(D~}xb zmg#qie0d~{^pxx|DX4#D0$77_vIPR%uyA@w7g&Qay8+*sQ+tCTIWx&3Uc;RE-iklJ z5ER5J8o`A0VlJ@v624M_WUjwMpB9CZLTQP`O9LtpuqjJe^>&|=KpE;PW&4Eh+J&v_ zC34JYxxdrOoeg@fCDkO=0>t6HyPBcN;s>;f*~omtep!^t*Y+U!)!mOf zC15|LiajJ)X$Cj_QvVx&6%ENaj6bPrp0U?4HME)|!nQs@$UqTZ4|Kny+(;1seHdRlh8W(zWojYXtty5m)WD=YP=p!#Z1#7>4 zX}l>3R{>7jG$MVP4_q_J;aU%#E}<05p$aL&7rVyzz_#(^);-2HZ!$r!b-W2FGV+qCcX0Flcixc8 z$c+1=3rEXDJb+WHJg5dvWCBsK15r{pfq&@tA^b7SwESg6K>d}>-0qv7E>iKPsRg{F zD(Zt2(x9@VcyWH4wT0_9&CL%IMzrP=L&TL;<*x+osu%o?#hy$tO1PHT>ImS9p<1U2 zPQ<{62uH>*pyOAL*jTA()pM3l9y078NyWKfY+9t_#`YE{^)bbM&kmYdp~fh?^=<~a zLxx`~?6!@iHxU3=+X9{Ovb;zwX_cce zy-%;YB^$RKt{FBp^+)0p0&EJ!A((Cw^dyU69)EAY<1pbU;O20APc*UBp4OH)<^!~s zlsAd=7SEi&oJly(Db}AEwotK|UFTG#58;zsf(I)G4@=Rlx)Ro(*>y_1K+~a}O{>Dw zDL;V>yJ)R?B_5w;+|fSQ9da#q>vS`Y_X;%LzrGxhBB($rFmAYFKIUoJKKf84R1zS6 zI)F`c$VXtW91HxqJDwQAz*#J@{mWZWSo-%nP>=lD9M^SO%M+Y+a2vM-kSJyDB?t2h z<0UBPkEqplSSIG0?;`g2_ILneh?Inij_1l+?t3F{;lyB4ceakT`VFbtmaDYmS^{>< zE9aW$u~P9ekL^4^Jve;*ir`jW_Gg!VQtH80X|m>+ zIlr}vB0i_VhTtY@H7GKT7$Y@tl{=J1k#4bzPg-cl^b@!E0V7E9es6v>eZFxnVWTKp z=Q-&o)A#RXHna`0sy?yDItuds9)?BTB5>q+ z$=$k#*STly3CjrNVi2SPWiZ-%hZEDYjclpI@$)C-d2 zka^?M*9_kpf#S84D9Yn&4Y10RJ@6xg?~iIjjTfL$R9D42ASwByL~BBqHK-&%=ky7< z`WeV{RPSU9pp{5boddy0Q+Agj;x|0G84IZVDf1yN8MKz?p0kV<Nbvm-$Z*hwe-+va6Pe|}yP3WYnsZ|WW)sCjA@ zz$qVIZpWw^WpP-4plPr#$i3xO(IK&J{GKZ9x`&C&f?S}yAc%Q4NO;ImB6;gaeg|kl z3|LN@47mz5wu)K}V>`ve#<=pFT73>ZHxSW}Pc1xbqI=2FKWJ2cF0Tl2Nfs6#>fR#) z*IvWDR}Z&9tE4-%^wJB8z0|Df?LvrM<7gEXXY7NtrDw=xX;xWejQ#rpO&Gvyr?;e^ z=njvXpl4l%)1_;hY|4C{4avV4I&KQWQK41|p(D=@p z>Z0v8^$b@fg9F#~7DMjm1>IH&tu;rF8pEN=nqNLLkzjD4-n-^2WZrL(W%;A3pWD79 z2i`;Cac+AoHbgLjLpU!(7nf@39KP%zk>FQWS9u&B3KRzXw;D&~d5v~2IIt~>`+VG& z7fTFqnc}V5Hg~nQCfEaK^HZGT7OsSoi3zr6g0YCL*cQq(-qB(i zOk`fD251dUfdFH(iY`1L@Xw=)Ek*Vlc##@Q#!$+?>#o+DC>B3bMrqDyI+bha zkPsfbUJW3of~9F9dHrxH^p%S9g$%eYXsC`-*2)jMR^_&Bg`zi`NTUmVMh%Zoxwk5m z(r)w24NAP#LlIPvK@ifJNQ6AOvl`l^A~=oO4#y`d{SRgmBuJchVc<@4o8!kfwUlYB z%b65S3_CoyEBM9n*VuneXRui3hhG(hz|TUil?c4m!^iS- zBZv8SZGa8N>ZNHE+*G^ZU()mY&Z*kR>}b|`;etOSC-SJF?so^(cP>!Z=(l=Yb-}#C z7-OmqGG_J5_Zu5)p*r+Xr6cM3`pvkh&qDmLOXP+>taY_w0$WV(gxgp{Jw#w?(+Mq- zPdUBWp|QNnX#wl1je%n8SF9mDdUUpitI>tvz0VA-4r}msq!=7wC$ptOJx4%h&Z+uH ztTfdpGuBMUwD))V?CeA>0$43tTOZBQroj~D4%o_m<3j{p9N!j}h}&x{d+@zusOjjx z=McU$ApYoRSd||yjr0(2(JWW#8c<}EX-w2@_O=Gf(K^>ct5xzaUVoee5eXV8oK$$q z!W3H|FXe7((iZ6Yp5F4u1fM1Cz?1;oaLv0VvTfZ!2m-!COFKb)U=3pTAxrbYUhQgz z7nBA!>df2Q;;!T*nCqS2Qc&DQ)7}W%B9=#xZ@JydTI$uC55GG$hdi{nj}7adZR+{C zdWE7ou30egu<)aw278L3S{>lGclrt#Q4aRXndZhhqU}M^0odiW8|z>~%T^Oin_gb` zFwRTMBC|uK8|7%d%SD14s!sJJBN0a(vPHZ+l z&A^>4WQCZ!efdEk$7{7WZK$1TVzC2PMwt1$Y#@ zjMl9D%sb>z(ZJnj-5d-!Zzc56_&QLK-R=JOGbJE-Sb zckh}ytPnni>hv_a?m=W#INPYJn;y_dBa=o#XPKP~(NBE<|2sSKcCz)-=WSOlSb;?VI)579kh zGlrfvd_&occTcKv6HpvB?>3dL6N7-@jw9kfHpD-yT~cSo>D(DVM`=AFr}LfmT%>=A z`<4(DuQGMmMC_uHy3*+rVc{C5C867709$(pD`z@NXtu04^Loj&y5zw?4+SS~=84{9 zm){?irvKioyf7GO_A6xSJ-pu;(-Sn2bKGYT?{hz^!E^V;yme+>1a)*nm8Gjj;UYKc zip$=_d_i4L+^wEbc;;X>>}*o1ab3(eB15P9;wl{fdqjZu(yAYcsr~`Tt-ezfeEw*s zA>p*86;fC#pL+D8fK%VgK!`;O#G~{ay9Nweuce@-^G^?28atB#9Y~lFv|@$OGhHqG z%}Qek`sMzi)IGbU*PG{aT4T(7+=V2R5DPrMnOP&z61`X+-Uw<~jv@#;D`*SW4ZULy zVx*??2qK-;upT8yVk4Y8)WRL?7z9)zV3i#Tc}(8#Ck8}_8cJ-pW*kjy5XvCz#})+; z)y9I)utA>W-f8w@C4#rNQqB%@IB8oBj$YZXi>o28kQ!xYREuEDV8b1v!dh(Izew?} z@*&6n!Onxue~*H*P=%6l*=DW93qlX(XQs|mD5qHevBEPs6CCJj2(jp{8n>|Z^9jFx z6c9q+3e5$xJmFz}Wkx8yqLS2*47LD$93Pg)w~*#c_jd#-PH!osy<8KPfS(VM?#DbbxX7g>IBRmy zXHf*!`(ObU5q`}G4Gce%loF8!kL`em2>$aa`WFwc7?14vwv6^EV$0BWr`Q$E38j^f zbda>d+nK+FgzOd){&}RL-mFKVnxQr za(<5)llqg~)_N^`klTSTj>7p$eNnerXIk6s=QF3%Lf%{f@gzj^gIiMQ-V_V7bgoN+ zhK31Ja6N_t(+>%QL-enJr)L>1FfjuB7B`%f8&LL zmp^xpA6tL~mJ?VWyQXQP?@h}})B2vq@_GOu7L^+~NV;zqPbMyd>g-DfrCtGmJ%=w6 zs{bSsOp_vX+FOXa#g>hq1@#^<=eyD_+~AA(r!dEcZv}Y60x_Fgm1aQTi6X}RY+-F8 zdjo~^8_75vC@lOp{`?a~=D`y)oV{xqb6|heH!T(9)~H8uC}s-3t;L;(&rRDX`k3&YYS4{%46?5#Lx52rqTix+YQu~5rlgf!O`oeD20y18iRWu z3?A$a)RrmPQHSYPL0UxNBc{2}mR0@djekmo85Wqt77@hP&N+GFmZ+xG&L)P2f^Jl@ z)~G;eZuXl(Vm);x70)PsF{n$qsCzr%GgjNC({%6aW9r_Vj*%PbEwt@L6`>-!j3pHd zXm?dBGq(CKMKJV*(MQSE-%?XItj;rp{xiDW1~iKEjaYx%XJJ#~+R9rNBU{kRYZtW5 zeXhRcxhlNa5krFHv&tywWDV@Qx;tH4P-z&meUESMUF=c;Cz4=3NTkfXs6YGm(j)mv zW*C^QC--gxyAA{rX$g5bcQwG155OCXCbqzhD}8>iBLHpf@da0z`utIQ2x|+8!@tV9 zH={pbXb}4X1c?frG?3Z=8~xuM-`pX`$v8NCaNw#r;xB}rQzW&8#&(T~Bd)}aJ@x3` zxby-E(elUL1~C5DC>#a0L1r)?5IG3LTe=GhV@II`pAOIhC)+qWA}7G|>{@CV^a(IP zhl;ycmwT?Mz@GxltAf#3|@xNRUpaY5J zLLK{I^KM2;(R8$nglNyhTQZ}Eff@yQ##*8p4*7{`0QE$D=*+oYLe?A7S7?A4m2Kcn zw$K^LV+=n5Un`8T=L{{@Une)TN zcLWQvVgJrj-?!~>m9lnj>Sg@fLQ&12#MF3UCYfq>HUpPwm`y9i`xgqppjbz#(3Vi%!3hpIAl_X$6i3#o5`KxbC;;eJls zZWwy=-)NsX0|o|RZ?-MTDv$cYXENHpE!deB|91zCPiDOA=Kx3Ik_SH(P3Jdma~mOj@1U;byah2VQEamsjr@*snAh1xmiY|%a)_tX7>($WV?PF~ zg(FXEp1%&mj`-NP;Gt3e_#PQB{9a|;e#fRHT!PtE0rP|Wq>x77MYip|K}DrxwJAV! zgOr9Ujj}KiXKSV(%>VVoT_GdYZ|NPZ1t|@S!QuDFY?RE=2@Tpn97)1OST|Y92`Bxa z=P?&iN09EDGM=lS!+1@T79x!Q52c@nl<<>73_J(rN(@+&D7((^D-)c!U20KcF)Oh1by5nlOu^8HOWGuJw z!Rv;fy~_CFO4AN}^ zhSDL|{OMfwJf4|iLG0`%Y5R2WxoIOUR9s5Cj73CvVSOBZ64o3UalNCc1Sr|SRJ)BObj-GIp)D8F8i#%`IY zdLMe@Q(Rzv8+(8#8$6`YiDjs5Yrm|aOK{0(^AqW<^!V~3Pvm3-Z0(SRD=YS9y?g-F z&626>j>6zgc$EnMtaXD1jxq2Ws0*9OSa;+Dicm%~1yd*OZ&%Z2t*n9xqRXLGS!go6 zr}eE!?I1@ef9)ig5f)(L1y5p@+DIf=e&79D28(Z&9$;*B#mRrR_Uw?K@#gv^$jxqI zgrpktJ#`VQg6loNi#u>)k;W-s8D$M`O*E9f$Xev!tWi1&+oI68sU^i&^<-nDq(7SI znh!~jQk9_bgH&-#la(!nPnHmc``jk8J1zPL-Zr+~SNC^iJ5^d+Zo*k^?AL*&Vmgsf zJu5S6J8~ce=7Zl@m__5qU2433$dK&GrdwaK>p4~RVpf5&zcqr9&zekR6gq9z!gp@u zhl>O+#f-{(g>`x}N?DZf*QrXk00dKt`#vi7bR{q;z<2``BKB%cWN0njB}sDUsW*QA z^B(`?vPnuYt+t#DhTa=h}IO(MwT}>)(g8as-!On>I_j1gRKUl*y_?{*ea3 zB{OAAORE5mbSnLVL{KEydXEh!)KA(`{3o&(O5#Y!{(6T^2se)0su~uq#OZM;s$T`M(7Q`4Vai;(TA+f6NRZ z0wz6{2&*Q$I_s|#_QA2#3S2xf%%1s@F4ZfEnXI-1l{S*9*hTwL95$2v2fP+@Mzs_? z^xr(1YsKzvd{E|FAlH;g1FEmLEoDY)ko!jYHEdYHz%lecFS3gg-!2V9f#DyfvW7s> zq6};10gzdYvJ`D0jmO}L$P0@58rcna!_ThKIcpsC@a>SKGp4^Y4FuI^Q|BA8=&g_$ z)@abvficiPp0Zujf4|G8my`V+kq#n@^l8Vhvt6Q$n$N2g3nkd07r;d6 z$o2=#oyVw9TU>vsj)zQ^p@aXRK=ZJD7(>wI00^E7^9cDV!VE5o={kFNpXD&b2hs>t zbp6yvaB4>`o}J&oy+|P9D_{JfGI@V8x_k%6CHgu|KR0WNIUF!^i_|ajwzIdAGY$=c zJqeg_ALi?9WAsSo*ePa=<%1uWFz4#fDjW1S`Wae!9t^rl(XJ)k@Beml6GtoDAZ@e! zrz$CKN)+~Rpu5Xw-kq-cJ25G980RzA+CLhN>S`HJMlIRwOpo5?aKhA zL&hS@w*g7C(cRPav7k6sdx52NS0o5Pzx1pos~kK7(*_yu5;5m_W@j(m1z`Q_GIeyw zqA_P&Jth|`@O)2=hH|%zHO-p!^13!PH#_1ia#?kQ-mWZ3iMawY;5+;%iakDe;<~b_ z#2M(3wt|wd%hxcg@CRHd(@8f+yMNPdQ@L>7d*X`P>hk6rocZtH`I_LpF(Kj~dZK@i zWaCn$CLQU(+X!>*&G!VVa+F2NZobi-fDz5%zI^6& zZ10|6nWmIQgBj3~s z1eW4Pa9v3IEL>=20oHR67H}L?BIRv3Ks905gM7n$w0C^Qw6ZcF9Lb;H!g{Dj^~^$b z(|9py&OqQ1kmLBwh#`643f&$UR+!qa%a20yHhG_pQh#q2%QZ*^h=4*TZLE*6wsVu~ z1+(YE2K<)L2+U>^W&kv|3=pRhT1=Ls%I135@qQvdJm1Y?7&m0GO}mY_ELlH~4%gOA zlq5kdCuOIpk=dkWA$)Tt@K_!eSDkE1fFgq>+iYS~-{?U!fpTakzs?Xc5G`63_it%q zLLFM4$?3HA4(N|9hDKIS!Hyendqyc5#*t0)Y?DmirT#&N^G~3SzdkFaDJ0VQ;X}O? zL0F#!r4v<@I37=P#t$5msMI@n;$@T}$KlW3;}i$simQ*O!?iSCUGi9Cwh>uzTvojYe>aO?GOk%fjDThCzEQye_rV#YxPr0Po1gfIeJ;TVNJ zIE-7Nd3@Q`3as)h z4Lo2O&7`7&DgyVWA1y(#`+|mc_%qMTcWp5Eo4D08Fk28$XvZ5i6T3S*pQ z(X#@Qpbeg5ZG$51ekplMIn_J!n1$HoyCnq%u~ur8KdI~=Jk;wpPQU-$pFw8qI}^JAA&_Fbpw9$ zQ)EZ4z}(ovn5rjc^c~sj&k}<1#>G;1QdXfu*jG8&2MQG<>ePnMzy(8Ph#qY4=H?ro z6pK3>83V@yr3X$N2Ys4$30$`5PXr~hXw{Hrs%(eefcm>1QtnswrKe`9%V$n%t&}TGf2X?OzG_ zZfL-BP6GGK^hhrhB7k-KE@Y*(0uDX~1then&MyENk<2mc$iOYneu!es(zDnzGD&+) zU5}3tp;SKzkV7&6X{Hg0Q>Gj`!^@{);Im}O%8dZ^9@ViWP~fsRpalcuaHad|#sq3K z5H?Bb!tIA^FTGLZgzpD1VG|6Mxq|}5$c9OglA>59)LMe+4-?8hzf8Am9DU-IL{yYY zSU_7z!%z<7DLGIS{-x6&_83@ONXzA?F5;2+(80}h=Qlg(T9DZVH(CM39sAxtZH$N*4TJtP&2pew4xk z$seL$DpA(*0qjI*iLWbQ*lVsi-SE4%$E!x<@yeRG@w>5MWL;N;<`c>7y% zV`p+q9-~i+hWRY}{wbh^aiim6y>XbXO(1qtRxm6R#_bw11MzDF6)%0PKNRVI_0-tT z1%Ug{0av7zO-==|4WK5E74UL(12{)7U)JR_`0_NPfgpwn!uLEvKbSYaZ*OrEl(nJgSWSVffcA4Jia)x zxywrplgr*pfZ(#q^-l(foX;B(3-1IVcF_apCqYiHCL`5nu?fV<3TTSbM zZ35K>p6>v@8QV>bCHx0h*MIf|aUB^u#M={ob$5WEcJ``O4dXfiVV^1-P*$(bbV297E-*{L zMws@=Pt4bY1or25R--37>S+aHCJEiB9LI}?^>>2*d!`&zw=*Dm07g6BK#YoK{=uVY zbUOy4z@s*(0j3iy0y3@8qC+o15CwW(q+s<>2m+{@s=XHh~QM> z`)Sk9i}=%Ariy1gw>ej@Jm7l0ZxKSq=;Ntl%;?(OhT-XEnm0y!X}~mN`nsCVh)Ur? zd5T(?aXzvaG_-#{i-0@d3=^_zQxTbK|9Ly<>-wRo9%dA`!?->m0Cj0dJfP@tHgas# zcZrqGFO|HCzON7cJZ_%e9VWdrpC4xw@6bwjR(3U(zKjOLR&Gx2&@M)cY$>(YR|u+2W%4gM3C9FM83&Tt0SK$M97g?eV+}FZ72Gqv*qeQ;=+Z;PQEPY z{1F^+0flKG`Yh4L^`j5#ACu6wy+V{_hB-gUy1J>Rn&JEjhwU1r3Y`K zQ0dnVx^>RShxM|>6~u;BlRtGw;}_u5?EyH>;5g$}x27j{k@d>G>mhAKoQ(yWu8!&uX$Bp(n(Y6kgMnsnP*r=3*t#V#dzDh`31$U>-MOnKkEZrl4z*VXaCfcHFE zoT%rKn~7Q`%sul9dDzxZ@uj=a|6g7mw`YdTOhcqz=UoMqfBj~Z9&M2r%Od|{Ht1+H zL8l83IiQ_7_BfyJ=09!zV`g7SP*SI4gj_L>it~cM_(r@B|nEw zG9#$6?wzV&EzLF~W(?sjON|;vYW+( z6?dt8IPY=O3I22t)52A(z&pJ^z<Bi1%K2qD-Vohv7~o_ zVEg)Bv);B85s9D}4;5hY|8v}rvxcD21s@`6;TBe%3xg52uI5nK%Z&tI2`iMRc;w`i zdWLX@mN)Sm7%4-kP@%Q=0NnAxonG-xl35V`5!rdy&aU!Vc>{!^#L9b)G^K~dbwttQ zd!7w(c`rR#?u1t?4kW$j;Z z=(d&P=ftZxikH!D@4S+nlXgF2HK0wYN0;qF5 z8Q++rv8Y~Mw6pb4e`XE8thyOp>ow_WwCt*YH#Q|n=EHZAa7U_ur3XmnExz&0J1?WcYp7W{KQh0Gawj15DRX?bCWrN?+@1Pti-7UcjvQIYZ5Uz;YJ^Gx3>N(m=_8B)f z7ds@ZD$=>ohhTPD4n^ePg3k4vfnA9_A_rqn@Y8MPQ~SD7D0~_4wA3Mhqy$(=?`Jx( z8?u@WI{@UZzcCWP4L6mYu*mae6WXTod07%3le2- zYFrk_U^PPlN^W7folAKeX2B0g*pQ2EXW>&U)lF_-1XqgykW~)DdbXZ)ud!dOv@&bt ztO3?gK=XeJ(|O^XX58jV3jd|OVhfMvl*=KlOAqxb>aHspUqa&n!Wlrr$iRfaU;z`G6^CWXiN-G;$XXlxS_LEzC=?3X`+Rjo__tWpr zO7e<300olrOB6gMrYjgL;_@9*Q*wBg+;x?fPA~zB_#Y6z(2kYvwEpTX*XQJO46q&> z%8<4+mh4O!_@`s}Vc*CS8{xNe!|LozVJ*GtXXee*Qzkc;#o}Ri-pC@pJ!6l8x9I>t zZEVqenKCh|>-+(S0&#)|b7pp+fXOd<6NXuzEv%ieN<>-?HkFoKSBx}B>A9yPFo)c? zXh$5L)|ln4tHyd!P6;J74(75m>0a@Tq*TAn`ht>g@<^EwfRn$ceuvZG4Yk%_iCghj zk6WnCVn6e~&K|rGE+m7NzxQ{+fddF56p0)kSGf?02(}lAL01HO;uWIRFX__@Ww1F> zW}*aUTx&Z7-;%dUSNi+M{CSax+~6grIl3u8g91IQ zXwM=H#U#)RO8a_FxC|4tP*MX=%yoKv3@WQjkhM~a2SRh$kcKVlb(Y&Jzcd&_GOGH? z=fNZuZS2+^J@T0hAvz!naC$GH;n%QkY^-BWu9Egjf>d<-1ar^C{Ao(v;uU%lI39Lf zVvI@znAN7X_ih6$I>vBhr;6f@EIvs36O$ahTP5U*~S6p(juuAXWz zwHln6BrYVaIHxYAmU|3JP(%m1p0u+=N7#A1X74x=zZbZ!)#X|0A+olnLJtY4uulMH zx4Sc^6O&>ec-jacsT9jL=O>hD$b(Oci_cmNy+d^#+U%3E8!GH!0vGrBHLVyRJb_AA z0GFNWROZTRYlRM)R*vgd_PtWQr<)CQJJTLovif%r05aZ@ z6l;`fl$G2NVqU}74!|oT97ZCdJ88k)hl^nPB?!YE7>>p*bPdOJB~>U_TzJLL4KLS-m+nsRXC%o54G($z%0T9*Is36V3HZ5OvgvIp@$ zm<2dKc3uV9Q(L^_#Wq6!qqqqi@ z>HGINr&^Wm7lL#h}oK$GFjf+m_v0?`jB{- zgT@4v)McK9CLuJ@rKP~AHKJz(!pV|yb9y%_e2hj}reh_aXgiQtSnIzhX#1+H)3 zfQ|Fub;tZEF3P`#@B%7!>8>5QJwQIYs2Uj`)r6O|lwo~e8ybI8UW4c>sO$Go;D5&l zsVmf1Yw$nAn@(G4258I)VI(mdmoHb?;S0^0rUMM1>eWIKSj4yV0Z{k!ZVn-bD%kml z-)|s7f<|3z!t-=dl3)DmF94B$G}S`w6S-R~VBq2}fnt3^Uvm(ZU?o;@wmnoy1MZ%O zk!{@^fys~=m4gqBcT2|z+Qyrp0Sttp9}fh$ZP z8(I~ZRUo3VujRE)o;Kz+Ks`m^VoL;p`~~v?@U%ENvH4SKZ%#`afr!5EF{5tQjj5IE z1W&aR%vA1UtR z?jrnH!~a@I>M@Iv4A{vsxjcj&)In6vUi-i=?tLfcU4J#*qBc3ZWdACTAu5@#-?OBxJllJ zbcwR09nCqsi8%GIs6jaNWjga(WeM`9eOEQKB zdI%d17K65@ERca9o#shX(1r5-J*Z11oIbC;RQ2o=0LsB2{z<#<_)v!zbrJ~${3T2k{kA0*fg=5g|L_V_m|o-N#-tf2YK?qU7Qfv#e)_DSktGBWojC zlR1Q>!KF^W*)b>K-$U0-oN(Lgcqmi{vMe=RJdePyTWo|J?V4OB?(hg;F$))xx^~jw zah0u8CJ!is|-0nr9#8 zirZ+OwkPRh{*1ffs(DM+ zzZ-Ov)s@Qa)8<9Isifbh0!v=ltKp^voCgkyT+=kqcTB9SHn@bL-R(-OBZAueozaPp z4FHTf5G0rAH6w3Ib`|_ekOzvvr6v(&J5{yIO1)J8psKE+p0LYk)Be!OAhvha3<6$i z?z~1O)u=k2X+alEfkiQ(rF)z&(j^Pt9p74~K_y=ivh8S{BGS(|mqz z=l@Foon>fy5`JFAME=y!qJNtNi=_)I;+J$?{egrJiib^!@*D}2R z&&{PPeObrY@guaQYsu)NsrTUrQ->}`9>=6a*2J{x6`fA03HbfbEuqf+D{n0W+7?8q z<-cW~v5qm=^n&oBfVzjN<~Vi!!xK|>_AYAi;XBY!e{|JS`jd7Wbf?g?J{jnVtXLv{ zS1c%-ZCB2T1o+J@)U9uEsAkVOYRk#4Uc?yu8rtE8yYvOlG>|+iTj?OL_;>lINALfU zb|m{d7_URb16|LQz!ULsN>(Gm#eJRP7mx$Ewk$2=LtBt%t0Bak1i^{w+(3n z*st;vDz*sl%lD<>Bp>$Z?vC*7=M45-PxQlSR zUFu8I23E8CGWAEZl~YWz`Y&ALGrVh)d{%~L0| z5ieLV&gsE)6YjijxL_GsW;sB6{Sc#jfH`jo%xIO=vnW4JYE?f!g?;?#A&?a8=y?8c z`{MUQwt$AqmeKnNx!8Y8glZAxdHuHb@saEhI`Ly$*vtrNh&-Fgv99%p!lrm6Us?fx za=|2b2X}KZz1A^Q0fLERCs2{1@z9Ml{09<_EEXO)b*QHeapAd@1qyHqOwiVyYPU># z!g%cYJ!#3=R@iZWA9=w%Y}8WlvFL;qMisdD3o+gokI_cPf)H$x{{wH!fCRoqp_rk_ zI%ckMic8LOu*Oa1$cNMFrKY;~_%X~-P(zPP26n|!g4U3T)@KH~hSuiNnO8NI|J%`!<+Ni7)X_k(28{*4?{`FGkKD;2II zK7Kg+kv&`-&=sK#rg%+~6OM#z1@1z%EzJ?jWGJt{Ta50^EClH}HAv1ZXkK{L%qkf} z6*s2W)Zf`Lz4Wp>eqy&&5O zP74fXPj?_U_EnR4Hg{5cvj0%k*Vaas|8Nn?G^SnBj?&~kkyu0?o4izv4IcXSJl~6A zh8X&A+dS?TRDp`6!3k*AvB(tH%8EDGCh8DByRLOTINEcP?5AM^XRJ%*2!ANL@%b** z6buiIm?T%y9*>r;BjkCUBK#aa38bu!KLR}RB&ASdr#^u|rf;tQteQD-(O|5f?0VoB zBCs$p7p;64R@+$)3F3J&K*@)7v6_lElM$WsGVFqt3pSMtYVX>fy{-A44MjMZ9zicp zjD(aW_eBl)=iVIAmCDV_BQ@dTva3Q^!>bxxvAkC)XnZ7B^`TPNm#V zV-rLUSbPu9k93XUEv4VHJF&2k`&nFyk8V><3>&Okk<$ezJ=@mRy;wFFZPQhR1FajT zw9}sxViE8Xek7~DKm11P@-kznn#GmxXWxfK-?&Yufz(cMcu4ICB(27Xnl1&3L#;E;fp44+@ctc5eUi!470==Yrou(9^~AV1ohziX>45G*}a_ zJ}i`>Yr$|If$xV*nzheY#;q_ophB_O#s*;mZvW5KVjgT*_OdbhWqLCGy@KYE4(nn1 zFQNrL(Ft{a?kR)98@+>+>HL<<<8w3XB@C!6Rep&pjyf~ZUjxxKPF&l!`)G#+RqQs~ zM8j_y-S`-hj|M-t6g0y}hV|;?`ZbOy!PPS5r7R~=vjLjl=^Jq=_u9)44YOzU1S!k5 z?{2oNEQ6qesg_ncm&`e*&BsTIh_Bojjd1hDd3m=v8Qp3`LjOH{aEotrI)V2>NsUlC z9)0@JENCi66f`TUgktk!A35?J+SHzSciy43Zal#q;FFmZW&++P$-xFPbCd$x=QcF~ zs(1vSk+WdfL^l@G_z*?G!SK15nu%@1S?!3|P3MOap`ij=!b%5PypA2B7I&bJT*-mQ z-?_h>uekIBE8tX!uuwp}e}e$s$v##R{9QYNfo{k?Yi+!JHGegQVzgRW?w9ij<{KP9Q+AA1e=&`C^2)K z$0{I2jN8t9ymIe0Ikh~^B!O`ckr{};I2iV0WvxRk+S{g9Ga9_}UBUTlJzD7|K_;${ zwXR2U8^uzhs^T^8T)o2B8Z2ZiGRcdWk-59eYz6sby0!!exe>cwd}>|oGYh8gWLhd( zL3Mkr_l|j!`vMMPsU)ZD62%Pc%yT6ph?7EADG2huugvvnOEM1B%Y+4E8&02ORu#dp zU^qH=(Qz#=Q6AaTb`&lihyt>457*Zc6gULfZ3aQQnrJS|Mu%qbvJ^a4?P$_*+m1RA zN8-x^x7$dLCNKrbR5aYtuxaMcf{5iulric2l!s83WP%h&z7n^Q!A^@Om=?Pe?SVY} z!urL9*@dw3YfW1m)j%(>)7QpnprZ5)%X}aqv`g;{-zViFLt9qO@rThAJiz_Ao(#O| zqRAsHbU{!c^~*&#!`Uq{(BKi`Ap$_OzVjWagf;je(*$UQWF=K@O}L2%TC$k*iu8|5 z7jP4QV1fK{G7IAqSE-IWwxC+d(R>@B(ByD+TP4xY>I{O=`NW$vY(vv1fmW8vrS~jm15VtQsx7U?|NI ztpB=9bN-B@LwRymS9EuK@{qYegcrC(?}PNioDMzJ^~|!;e`ot;cmOs>07h zps{Q}dRpKjV>09{mZu2kn!mzuK_dw4qb(kvAX{$krPd+{h?G@snyZmfc|g|MwWr7>Eolr_0T z)836Z-=Hc)n`|QbYQ&|Z_XMU=;pm!LD`)^7b*sinLr>mGU#i)cBo2)o&&@*p`|RL8 z;zYIXj;(2Y^L6h%LY#JE1!{sU zDmir3_dN2xp2e-yF^UN;<7X>Pvcf)iqx9zE24Me{^;t6%s*xb_*&IC_qWV!lt!h2q zgAV{6a$olONmZL}H?#okJ1?u}BzR?)&-LP6!@#R?co0u&y0)`@^J(qsHBvI_u#7WI z*Tjgjv+Yvq*z_Sky*liz|K;>JPKIrlkJ{ZGt}c2q1AmS|ijx16y#yOP+?im$nHrK?4s*ATSJi?8%FEZ&Q5tVCsCGDf4}_F zpm}h}mM_9P5|$*rtd3*D%ia63q1pBnk>ou;G`?}faaZG|GErjG%lo*@d0`MJ8#T48 zK93FTLsc+(ZShsn*>h0|=iHZ-9PulC=vFxQ(P9|&yQd(@otgTeo~DkqDLXmT`1UVi zfDuyM*H7mr9VZO)PDZ7yae4P(9};LPF2okweg+O@h*agq+37w%MZ?^54Mhf=)R2mLL zI%D#2%lqj~?F>=C2LEx#id=0XuPqh|VmfN%Hwts5>o-<&>o+>oC0nh;XE-j;gzWHJ z6;}bRJsVcu7gx9Ev*GUvH7?>x_kxw~V!WsN;cmwuJ<1`%q}ti&a9ks(?*isM=jN-H z4Sf=Z+W2QC=BbK7i@?i)K~j1RyOB_}PGQwwxDz37YenE+0XgoUjyP#DfEgNDxtMzP zyp_ks47M#|>giPCL_TK= zi6G2%5SAr@fBd5BIk};kH)iN|a@uFh8Z(`LlbMo7MSqzqwKIWy<&cwF4GIvS zd?5XgxCNx5)X?=SU;$$rc%tNd1%XEU&Yw-KFe`R7 zxxVBb^g1@1#Dq%Rd>zVx4Byjo>olG(D|iVv@A zG-Ofx9;FQIXs*!ZzW*qd#I)N-#Oii&rZZHX0J^ItZMD=eB>gl=DDj)4dEsI+HX^e? znhw8lE>i~EF$m0ec>}MY_^(FtY!+pjS<#dZ|NdUlVlAlwRqfb-kMN;BVTx57B|-SI z`Qk;I_K%hLlFXLETtNU@`AxE6e}YqnAeogaDS@bl7+Q#05DY$Z?q|K)jD7C-JYwdf zUzblaUogwTN6w>glCh4ZWD@02SD7j5jMr&fsum{r1O>6i(u(6I^5Q~e!7>9H|NJ;3 z^g7(Ym2j7bXTaSQQ!D>-gSB2)?+U}_(@JU8$}qDk#l>zPahPt$Y~?aQ?r<(hRQI=W4Lntm@1r!D9loV8YQEmUy@luHcj1z(`SE9eXP7gwqa=eP6i5NJ-p-@IM8j9$&{ zO?P9bMVmJoIU;n~f%Nj?8~_wD`cKnV1Q6V4bVvlBZ63kp@Fu?k-ez)LJ7gj&9#EMQ zXrHR>+D8F8-^$_3>+sOw=5cZ<52D_kB}Dea0UBh;9%o{`Avx^+{VPs z)d88oW6=8HsStysx}uy1qr_m)JIf5v!-!-(!jcWPtr16n)Q+9QU7b9TFB1$O*E`|? z%^gbqXxwyO7hB5rlS~chSeCkW+LZSq+W%%RSz_n0!K0ceLcvVXUCxBY9r7b1s6R7N zEw>9H=|_l|GWZh~5Zas#;mx8rEj|Uk8-wwAjg_7<-g$j~$lV~A^~%$9cv)l4XklOs zROkRKAtpOY^5;ce@6G-{SBvP(RA;2CCfMri2c{Ok%Dy_)4vyyjTR_l_ct0-zaKJ{? z8VEcnUMJjQN(bm$g&&OC`=5AQU9V_H93hjkClC;WRhit^l~=CTn$=|jVr>PCf;X@s zY75jD^eR|VXTPZ2!#5d<@02%$5YJnfc#=Ua8s8>KngO$LH{wb~)GkZ}0$&EfVb7vzG%KM2td zC84yOhA=udT^*~y9)Xt*ZIr|)^pnjhKH8w#;h;OS&|8AQQ|IdF+8 zKM&O|R%{YoBlhLaQ8UgJZ?fL*O|uiXxdDc|)%EI-5Eyf%Up+DBx`sRdEQRE3{kJjM zootic<7bz^2D1=+Clif1&Ju5CaNRNM-zVp7I@F4;qFX zne`_b7#fSI<9vey+M7DUxlF5n_O8S{%6k%po{tQe8v+fY$>(8uJsA~Gz7AX(=~$8H z(N+dM$D*Xs8WOwCA+LB(Ty`!=&{=0QfeX)`r99LsvIB^{?TeoQ+2Vc82+457+|_ax zRoTTPBV)V@PKQIZ)!D`bJj6P4f*u>(Drt2g=hxL zzmWRo_z1C7HzX5wSvZM9)6+T$FP%E5!x&6XlIqURQH40y@84<|s}dILnO64B;{*?k z)lph{S2X_f^SfKzciH`-E5m1&K$y?>TnbJf=yFbp&#|q3p5kU*bO8N3YEMWUc_6*+ zB$&vgdP0FD;;Fl{49(Jup}A~is{AZZ)Rs|Y0Y;BN)75!8>Xd%j7z5dVuO+gzje@p99td2 zMU&>H;M+<>!SGmaJtE$fG(q9b!(hAm2eGU27`!ke#w|nrE!h4hjD4G@RKnv8bILiC zKd)R)vZHsD9pK`D%KBoW`soY{4deA`>Vf9@4c{}1X_3CIr`U|ZY3MoR=9^S1AdIMG zqRHUk(%|3qLeX*+4}Ij8HY(6k4$rP)Wr&y1g6W15%crfroxx9|Vt#{r=4dFn=P_>& z*nqpYf2fC!Zm<*eEG0+zMe4bYZ6*KNIYCE;N6?<-6R2rLrc++CCKmy~*J z$bC_2fQ^6u2m?haLb)O0L7^k`PAea30~F_})^j&*++S}LJB;W#mzEnz62~I-7aFUi{6Cg*n9}C<$qG^ZbRwAX(?d`5sVOSVTLCPd(^C zN>$nsFM)<-0V&7Z)H-_2sjR$3xPY*z&Vt72Oq}M4kKDDN9EMP~;W+&28(SLxH+QwC zifl~mvr%TU+kWF9_kNAEs`ti5R5}I~9J#!pZ7cNa(-IfZ^uQOmYZnsZZ@o;CI_7Xc$!YFX`viCeTD6TfOfWWoA}2r_Ka{eIZ?5+D6(bWYzK zDMZ!M5*ibVDwP2lwm)$NKUZdr1kghhaGsG=_0obM5}7@>?MEWCzNxoNQ*))lvJU ze-f&ixD!ng5ze~Re^hy0dk3r;h`s~NF8<+|Emg4TXzU41#Y}_ID_j z0o!~w(GQ42FB1L77JK5fXl;S15BfOn>#@}=2cgO8I&IVSY9jJ4h=hp~ z<;gG|%W$mFc^6WGfUD&#D%&pJ=l|3h^$7;}Lz@O+L>xQwA=H84K~eZG#?;O#t}iXoPDV%r~~ ze$KnRGtA|QW)dm)a%1}womizj?-4O?v;3b?H5)NWh#^wv;Cu0A?FVZ9i*Q6u3({?T zPfSU$0zey(@wLT}SL;zr0KLhLKEf~hbQ!^u+*-g4-Llk3Lia7JL(N)H*v96Kwt9?! zO;3qgB3vKlXBq7$lK@Hg)cC?U-m;~6H7vAK$b4q3(@cpHm6(hj+!~QQwnf{)$=old zw#{Knxn2@B3o655dW_Fsl<*+Gn*S>Sjeyorep;Usigh_H%S51B-zz~hv{@tZ4H0C= z#(G%va%Tga(8vzJoCV*RM?LTdt#TLLc$UV zLWa#maP#sz`-f1t`17TIEa5R5(*X~qQp)D}oz|j0S7)F_w>0w)i|B3X3!~Ykn?i6{ zZLnr&J)@Y=%+Q3z*r*wclP8P3@=wQ7UrK*!XyIbrHB`uQ=>6~_9pWr$@mN@dnK=5P zOxsx?7ZN}fM36LAJ%Fgj?)4~O;CkikDC{#=Jk{zH%gNu(BNJGvn|L0%jfw{$x?_g5 zhcszn@CQE?x5H)>>vaic&ioKD*fd}!5)KK{?B7K;umFDc#nSEhNk4qL5)ahmuYWQAg=5f5w!`h(Fv zW>M>uvwLmJqm0U86QVUSQW=De?;>zh)9$U)j_$y_23v`%%a*CkP+?B;ttP1gIy*znOAe?a=14Hn_r$$^RWw` z3lrrNvkkC&y<1}Qb=Cm}c63>QJ8J;hLg2GNYe9DIom1qp#M6xSa_x`u;bzh4-Z?%1*x+I$O$^mUgW>*|C#`}8Va1BR^I#RKUV32DTYk%mjD z?@{KQ`H&W6h5Pqqd4#LkbEVYf?A^dk&SmCsQ<4HWWRh))8~;V_}3Cb z22lE7W_&!IH^+ygCVr}&o&aKFu62&)oNwbH!YasGWY;=xh5nV|>EJb7_i0%-q(d5& zsRs!)$!3AFg4m~ZP!~d)NQ6Y{E2{x17}j5mjYV55g5f zYnwdH;4sBgL&A_&+6@dZr5*|F5)-~BQ(CbXerXOn@!WSXV0{yoXYS}y>DrvAxKzl{ zX%b}!+=rphC$FK&$He@Uz3!l2ryGd7X224DiO`U6`69dI$t}&p{!rg!EGuv%=hp9n zFKPqVVuaza`IQA!5yPb-O%a!==}j*6+ZNL4WA9?zx#(D@_W2Q*R*>-Tp1A))i!&{l z?IUMz@m|~oJwatGFF8j$T#lh;e8rm&D!&<6YH5kO!`rtx7V$71+~GVOJdSSYO!dy8 zSGIte7?gh3EK1c6*q0*`s2K}L(Nes_8ZUwyZN24+Zt+xRdyJJFzDk7 zyytVzo`rx5aNcjS&|-mQ=AiBLm=H0QINOe6f#@y=Q{M$Zb^*&~9^kSf^cmL_QHomc zJ7H!8YKfp}!`nQ8*Zj1HTq}$Es=~In@1CH_V>WRfK^wSjYgtr)z895kkm+F>X`^uc z;_h{dq*!hi1$b`g>BA*hEnC`Ch_R53x>?KrM@SMiZeZR9`(@*QsuUCPI=hnJR9Ru1 zsLyMhfa7!Wfr_3*qgf7PKTFj(3TvcQU{v(4pQdGePLaZ|P#1ueX+^E0mvw6_r`*2y z+hkMTpO%reqlo8rEtoumMYyR`x95TseYL1m_pdJH)i3UHdCnLv=BqGuYU2*#`|3Ub zazNuE^2weLCSs>*DfBnrk9*=0x$xr@GWX=*rK9%YZ~ONp!5szeJD|}tPBl-aX`ToW z?bmF-r#Wv4nB3g}I=5rxa{m&;6<#jfWjr3aY1nYEEf~DLrxq-9h@;-pVe-!qzz6q$ z`e}{UV3WZKxpNldjTAbQRl-k5b!2jb?%;Zd;tJ454``8NIa>0FS*Ch zt>19egXDAQxhVxvwUKPejsfC|ZkK)E{8|<~0`q{vFR~|r4g>w7s1xHxJ9%l3v+2E~ z`~>nKQp7ADQq@tIDm8+0moRs;29;6`^+tLuyg4)4QQ!WTg{qR5(U-fD{_I?hQ?y9D zFl;_o)o-6Gp1aA;!*(yXHqs?gsCw_f3c+brqLdT>M!t#6@Ef|ZkCVSb`DZEAc1uu% zVW0tJqG4A3ai7?GfyfllR}>Y&l*`7B``0lBCfo-_mp4mUaTp<~^Me|I z%4x=^HLvIUq@m&wkv0?klb|&sJ#+lgeDUQ{IS60cV%DRav>b>Jd^!GO**(lcq(kbx zfJXHCrFb5SOS@@x>Qta2mZI#e#tT0LeeGXkGPc{n%MNy#5C))L0YnSYTM);HAn4QF zXqO^eYYVng*K)31X9K?5w-Z)1KphA4+qNi#FgHlMW`%rUda&D{vDL(floDt%IbkBI z*z}I89fDtfZLejvpEak}3o>n+3v~{z_fu9$axjFLj>Cvvc$aX;trqGUKDA9w$Z2zY z^;lm~u%9WpSgc;LFz~e2>(m3@)A$63Envs=kE8DNWV~Ey=tu?qZ=`+b-BAuY+s z>_enhEw;|qFdv-Au@AN!B zE5`LoO!JeG$`gl>M=GhQPE9rsNk;7m3*Ofd_+qht5nmPiiuE-@)h5d!tkGI!I=m7he?OJg)?I^ zDhz_JU2wpV_}AXC>^5k*V}A^q96nbu3y1RAM(JWB`~(*N;5c934*sf0dwL&6N4jGG6W%_eDz+sqPbGbdl`RQ3MOnRSfP)x zrMUKevW#33XW%vCr1&q8dfO0R8JcQI`08Q35*lC?&*5yAg!M3_j!PibRF3yZgGEt;KSdN~G*r{5|6YAlsW(5+XVjHmYF?UKCpBnyrh_V$DxbKx?Kb zvB3hs7KCxY=xASf%bu2P=yNYh&>*MFjOx8So=aNt&rUH<^cV$p*HW;C+t)7(osVaTE=3yOp z9iPe8a0VOl-#`55xMY(CL5MSld#?nQ=*{rf>yCE~&424jGfGt%H#ARg{k$9o_XkrI zGVl+wDz@Cw%|Q%RY0ero@H-BffTLCOP2Rj6Xzr7ztrs$QzIIqsn8cQPV%>UD_zE_u zIAwLh(J%hB$y9~0DJ9&{Ap!g#i6T~AXtW$G3rgh1g3ZnH9cbP9H=C!E7a zQz{wT7{43hT`B8SD09GHbg5=6P=eQr!{3xOi%XqICTsOFh2Y=yXRi%h3IDD`++qRL zptzG^>#qx1z*55apW0!2WOvJvHTYWjF{y<(Hr>DUw+x8b15f3+W+Aec$*OwoaRSXn zSDxWjFzccm8`+H~Y0h{jC}e+TRF4v0y(j)K!x0WQg(FwH;0A;$eRVT(#Pob*=)nW2 zWIdPMLMvaao$#l*i~6Fo-UkTcvA20O*g(G+8A}p(hrMJX=+9bB$|2L=#3IHsvnCQU z;m3XFkRLRDhw?^LoLAuZt%bZtcR zN}au?3N3hc+<&{vJ5|xRGHEb$VWzH($8-qkEVkqM*-@qWRF;-W;1wm+9K&0^wsMsR zj3!I6FG#~bPP$+dU@ zJ1Qll_T?*l*oF`B!?gznHYBN07FV)fYwqN$->(2KL2uYmOA37g-uuU5HJa_~=2_G} zSDs1C5KtY0d{Z)sRvo|fu^;a!T*Y8FL}fC&=!?Ff>T$hEjfc8C&0S=9w|^o|&;`UE zj0;B}YcOdo)5Gfta)iTB{!LK z?ao^+0pma*1Hojb6h@&;hnT;Ei6(WA(w>?RrUy}IDF*%-uk-&ZCm24ru-h;7JO+Y%ssiD2PtsmpbeKeg3>u#t8-guUq|95LQiJd9-Ne?W)I` z(SmF*F7+X;PyB%?+-tl!#l$jfQGG}*FfJpI$RCl@6CN$<^ykHDEYq;t)RjuIg*K5gPuON2bGJT^7LH1B)V?0WqGRp2`yY3=v^@oKPj}^zD49Jg^=4~8y9xsg zz}(;bxyAT_o`wXip8%;2*LIMdjtq`KtNtrZBJGu2B@}XRQy4pd!l7RvN@5O z-;S#-7$)IrCGZVDnO2wuE{LR7Acu+XGR_XM!#4dkjc0iKA3D0yRS;nAUcy3dkua+6 zU*lR8xI*B*JCu8g!-$Q6mA}p7?BNqq4wF3m8iZffS|ECHXteDRQ_)F;D2?2phOS2 z!N&#ttm&o|7y+Lw08& zI%67U>xKK?9&Bk}n8b(a7}K6BU`ZA&)}gS87b7p8W&%DF4S_mRsSYltS|)sOzWzA` zV!$m66O-8PHrky#IAEydLeltxZ?~*!h!*7r(akx8gcH>iiwxdw$soJL&pvUs=BkuY zqH|ql3`i`NY*?u082zX;BLswnl<0_JRRzTY=&0iMOjw~@osQ7Z$XX*F!NN6V`aiTE|{2H=5 zU(b6;4&umb6z}0_0k!H4TxxhazpoIk1p-s2J8~sLmD(mIjNRREpQKG zdL8+h9)4(t_zU58qufI^YZ6AxoyB%ahqTRF5yaz;?jK><@rL2~rC3^LXo>ImEJ^Va zH2VDxQig7Ubn*bFPf}^CVstWSVkExcqH}2-bm;ub31CvAXzlGBe1 zYn&8>+7fZv*Sn_6TM{q8xtF zE7Itj>1MlfO*9FZ6nj@?1Sbl+ZynYK9xY6pLqR~1GPChY>*QW+xuQhMI~)>2{)%Q( znEo!ccnVVllIU}Go*pOt-?wxI=gm*u%tk>1_r$Xl&`3&EoKXBzc_#R^ZG7a>-5P_? zGuz3T2QK?8x+{lo|FxBVkr;w*D9#JnG&?rX9?$YWIc0a&Fh#g5M(%RKhOj>X5~=lg zUcds0_m3>Lp$tDR(sGQ%r*W#*hMNw+J}G=k{{mXx$#S2$oWqEEUoXG%8T9fzSqWYv zHxYudBf6vH^UVQTP3PV=@MFI}%+u=T8Hr3Hc1l0>hn2Yb41WIKbdF0gSSk0-{qQa{njQSZLg$E5bj4jQ(;5xHcnl|>QDHNK%av;UMGWg>yZ=CQEdIKPi%0a zUqP7*J*yN9%TO?@pP;gyg9*bX;u;A4>D2`u{Ubamh*b;ESX@Rc_2VkyRe%57uP%FA zmSm-r-Rfx5yS)q(U?D^?wcTfk)WeAG6r%487OF(i^=0_c%qKS{90&sg?9XxA{QQRM zSEL%s@(EbqSDyDFJD0?0ld&kmvCMBk*XEFNBi7Z_KPS5Fpp$vBAIt>nMPKEjt*QUJIhhVy7 z_1cYIp2RC3YMgur79cr&Kr)xGLVDm7|+ z41>Z{w$TmNn|mHy$DKFW>G4X6JRG#Gn;h4ztBKlUi%0%fX`r^xbo6)zaOk%GJG*p( zcS+`-`&XVFPhGjR`m8%z9OdbYdsk008; z1|z314;$5q8D)8_GaK@6q0(+ABm@P>L%c9c`!F39r_F(Ll9@+|TKuKHk&4eBHe$x0 zCc;ev-D;ZXlLG&Y+>eB_1k?Qv#cF8bhO7j9_ZDYw$u;z2@r6)Zu3ZgQu~OsR?E2~yJ~c- zyzuTMrSeN>YXgNsM~Jr2eB!VLNZ7(@Tn^4dJrCs(&!8iIf+RhJ`&7y8mlrmAT0r98 z>pUj!-{-=X@gJVRp1GH064JF-6{uHfVQZ29W$ig=FmfHZ@HLlyY$=qPwt_HfdVQhM zz8O*Id)ThIv{NBz^PAK+y_Lc$)JL<6oRJGdV>vPdRex%6rc@wi?w(#+D?JV&g7nRr zej(ha_qwv5|I0Pxi#NpHismFDR-j?L^8DpJY4AT}jgov>p{aYQe#zN!E%FAe@vA!y zK=`|q%OV3DEZZ!?aNZfOBAnD#V}WLRyur85BG$tM6E%KojHuK^yz~8uGci|GV7|a| zJdQ&nnGxFQf%W-i&P}|vakI<~{`0y1eVBKwbYN?0(F7j|Y#=lB&j;AUvS1w|qq&WS zEq|&_Y~yV5q+<#S_=8?@w`&!e4G6aPQ>rxmD)<301NZFM!aHxXWLFvI4fapRf6b&+ z`W&LtP)!^VjMr}gEAM^Z7RK1^3B=VE z91zxc&%1MdTczVk&qgQ%RSzr4Sx^vxr*}F^vvG&fMkPtt7*vfGeZi3U8AeQl+slL9 zDA`?e{11vdn_Q2>*}<)?;Zt4E4k#=$8qx{jJNAJS6ZnsSeXtxwZod_DLq}yyy^vpy_wl}(xHy{$yz)7%!| zL`4pOU>-gF&`;Zu z0Ual^9O6fV5WNILVnQ&b5Hp*v$9*{tkrrNnAVLkd&%D6RGv5Ah9fYs|}ZlrCXy zQyIGyFq_ye?f6Nzk2=2Z+35t@4nHO?k%s`FslJmE!!wg@4Juv42aUb1Ja9oeTs?H! zrHyTOCggU%*>Ib6Py@O2z#rpkj>+wHK!1%u#w&C%KON=+>F9c5lv`GLO5;%OA+BS$ z2p1)MZcbK>ofu?a?98cySHFp)z}Ez{%O@BfoyBpcl`Ux4@)9ugedRXPnL?1a9nv7~ zjz21CIv+HEnEE&+;V9CUh@-h!LxNTTyP_F_Wt@a&14<`v7kcV6EFY5}IH-G1-Up)i zngg}CdUm+byD}iiUh_ODC0j=D<=C}g$Jr4LX{MD%L-h$ekO5SlaJ^#r9w_%A?cPWw5GHW-*WoGY3bjbN=*3k*a`Ynwu zMAm>0_hOG^a`#a6f+RmynH9=Rqtm=IF`wA0U|Q0+a`^1HkIPQR@6)>t*3rM^bWVp) zSc*+JX&T5m+(Ka6VQr}9Vc>NKH%J3CulYaDksA%1TddFN;o@bbMp0*%r93|d#r4s~ zl{0LBqv`Vt?B*UDI+aZeN=o>zn!Yd{UzS6^a_OblKOOofY=14(4VQR&eWRf?&YpMV z1_5ut1HkYG>?wGlV}h$vhT0?Vq6Unk-W_RY5=M`#Ylms0dWR$ICC(qJ@!eFj+8+Ts z#j^%k@cgtk{1f(kC^YfIu-l>N$NdMzjz%L$yv$* zx)F%>{J^$k<^jnc29T3rnc1{VN}LKmwIii1$g5JEB&c>%VwCv(tf=K<&^Pd@U?Gbi z=(wr9C76o)(9ifr%GG64Eyp7r`qP$XgFY;Vq^c!&5?V;VNlGnr(^pSckrP<;I!2CFZHrvQ%pONzbUc z>?if6`{EY1e0(CQZKVhn-s3$Zk+IF8PYxn#CO!lk<0Vgu>tMY`?zXzjkNSqqVALq2 z<|#RliFcH*`Kz_08_}!f-7Rkk@iDt@$xw6i4#l0=P)feYACQ0>XF}0r3P?6Jx4#mIGijsuTiq#s z>|N{en5)44Zb;d2hLAy*%%!6r<)pY@u-WW3sO*E!OcCBWYI5ik1_kSp)S7X`Rx0tt zP`EKv_2k{1P&p}L1Wj=evmh>8Vy$sAgqwpYxPH1Zx4z&8sN5i^;WN?K{*W~ZH(@o< z7PXwAW)_ZU^8KY3C0Q{4gU-S)l?Fo4KJHw=>gY>QX8(K?6gaAk9(Z%^4 z+r>^ez8x#iV47Y!^dNuP1 zP@(ovVKm19*?z_qL$NPpv;cZV!U&=Cpl$SAOYa`Nj}X-!+8o~n?8FW`B8T)A`%GsI zI=35XXqTWX3o_Ib5H;9i65mbVgtGTVyCrO!O#W?*XX-?%sPL7dCM|J;BMrGU@GI~D zbT<#af>OAId%!{6Q@>s7VpB!&$B~TTi<+F%6s3S=r!rrYG8tHcp$(Eo=)f|BXN+D7D(xk$ffdfQhY~&t2E0zL z8l?lv&BeCnQ2FV~Y_jU*UvZh1Eo?GDux{LlVtpItzaY>GcSS!9yRrEflT1E_+F!>% z)Xu1-H6S_`w2ro)HyTaxdW?ph>r6bY3%5)is(?PXCGgvv08>L=_tzn^ohy{k<}kib z5lYZq5lh0hx2mS>XZi)E=fxA)gz$E){Plg!(Xy*76nIJ+;!$$ij=RkYt-d7CxPM@! z#0K6Ok7M#%*~MV)T=wDqXYzqrZ4Mf!zj2U_pks`TAB6}2MHI+TGA-jBR+KcKGx`La z;I7Iv>WC3E#ug!7F3dnb6rDk>D#AjhVM+7H!J-2NRwQiWejs-B^-H5fowX>F3TKm{ zdyV{AuzVO(-_6;QZ9LPTYqwKjPXr;#W8`qY?eIsJ16GgOUP+FKtqEUFC7Ho#+H@rNsA{S zYlWuJzYxQJE#(KDBVIA{6DO?UurH)8E%QL^{pRW-rHbXr2y-2O78HmB@+7Fk~92m z(aA*uZ;O8=h7>VDJK=`?ZIh|CO8oiafYmcE4Q4b zduhW|SLbtf30|m(r>sA!dngsyI4##g-XGmC+`s&{j&{B!2J8QzX{L{R{8bi57unNv zQa+IBtpLrV#FaqseCX(-_mE0PyTs>Z8R5e?chr}Lk}!u*=kNtYaE)6%vili#tFJ&G z=AEeE&12otdX=Hj&yeE8qVMDpfEJ=<t$LgX> z3(x+n6~>?$d*z2Dv04(Y7}g0YGyaJJ>S697=JUQKljH|?8J^|!2Z%k&J1N++85pCi z?IeoaTPpY|`#Enc)7*yK9eC~}_+y=B%e3rdKnPOpj*pIi4F=84?!&PL#04At;$ZV1 zfrHi)&K!UChi-l);qHCC%6!&Ycc&7|x&scRFQcRCj@n#!?@w-%xkjK(x@uFUwNM^3 z8C%qPWo2<}*RdBpqCZA`4<1aO8E(aIPxqvh$6WEl2Po^&u)FL?g-t?5I`R13>(S?03Xn)|Ll}LvUlp=3lmfA86HHXPGP=}8YoTc3 z%L#qL;G9^w*_M5YwdBX(F1<`>6$nyV@x_P;CN6}P9b$O_I~?{8v-g}v5=QfW=xj!! zQ_C4av$)9Sx?`^uxh`;FnwA!NX;F=3S=iN-xgmRz6cED!@@~s`u7VQO5zzlb1rgRY zbAr9yD1B-P>|kt297dB@kFyYOI_`k{P_Cn&e6KQKX9umuudDT{ z$;=kc#)+)Ss&<4zPFdLC6(z|JeS!Mp1_vm}_O<@o;OJc|TKcr0Ix8B>N2hK@OsggV zf^3W^7;k_C%z%tlkN^iVVD}7#6M$=41WAx25TbMPg#a|pU}K%IQlML;wGggH^2r(ZkD|+WViV~dd<1| zX14avnsBGSR+HtLk;*pHz( zP~3+|mA4vRx_iPH^*Ey1--$0=PX(mzvnGN>xvMsGd$_n9AhnPev)h43VsuN)s#{Cv zP>ykw+em29r=$Mpx}b?`CZ%=mc8RQZ_z;=D2^~bNI4@%SzaVCe8jZ7XGY%ews+@CJ zRZ{7`%Qp1+Z4yG%xcMhjdZrCA!^J^?4p+5jiR19^4baE52AU$yXL5%|3a1@O?j}xl zq)M0nQA^uR-^jW+fh7DeK^vR?T!}dGjCGef3Fo^ z<+s*9IaLSOitnt%Nvt-Mwy@vq@yu(u%rR}h$h}zrSZSFec^Bo1@Ev5C!Ry>+xMgSK!KX-Jq{?bLJh?CblBjMXdVTT3OD}`@E znNvizt{=0;9bQTkRrZQNf?_O|iP-;5p1iF2hQHj;>1VXJmj&nQzQm)ngc7GH8Vc19 zH1L!{>Xew(NIgt7^u=)!h+VH z?R%jVkKd8_A_|@suzW4LnQ?tj-=sT0CTl-t&4Vj4JKQ)g#J zRpUdbNkx)|PL^(j1L)sVw;N-I+y+%|zT!N#6yaruWlGRSN?}O*Eu5WpXj?6zIC4{8 z`@DLog9g#NlTfIKAm+AC{GI&_80uX_i*e*^(wLbK1}U|qL34u|fL&{eE{HZgTUko5 zMkvUnz;t9^9wxsr^ZmOvJ95DbFgl;Kl32H{~HvSn0Uun_wi0P>fb29l+j%$o z%aV6HFC*YteMOICgv$J7wqx6Vl7Rn*hnIY!#Q(xJo;>%-om0$G`kfOpg;P)9z1c%7 zAS<$_SlPOcbZu|Sij-n-%)p2}Ms#6?s>DNI`tGs|%sy3X(!EXVQQ0*%29`+s!|8Z7Z3!U`uoEWA@;Y9*LEcC>!<9SHsDB9R!r8srk2r zrtQdF;At#!&`-NyhuC)R3}AOC!C-5KC7Y?zX$p_F>8%2_*qsxyu5w6t<)T22-KD0HDw~&2__BIU-e`^Djv<3FjagTeqk+Ks2Ku1N8 z1^qz-nqav0ZMo2GRC{Ap(esd&-VhdPbchOn&Go$| z=g=d9fQVl!;wNG2gkO=**Ft@d{eMm2-N5XtjU35P8dX@!cch7tzhS3`l<~}T%*PN81!K}iPaxmagtWY<)oJasYYhU1F@91toJqx)1gdgNvX;#RVMKeb zE)Qmibr;*w?pav|cgg}7Y(lKMB5&;aYNFM`dX{s)2^Mop~U4S^Ts+ zxxtq)Ieoq9BAh_sk98=azH;)D;*S`B9$)44$1LCBw$S_gGnB`Yx5mu zisUkb*_}8xhy@~ zXO$fk&~@2KTOs8I<(Ln@Zr9W!Q%kZhPC<&ww1q>H^w@8-74Z#cg}L(2bHLe>Q2PA2 z8?M)dU}Ot_eZUc|1BQom;E6jo5oiG!S3T|q!Edz_-RhwZp8wqdO80UVlf?#vKx#Qc zYmVk!?%+4CICZ`IYbBHV!kwIia9mZ;qG=^t>eE5up83mcqMrtAa%VanApRY_wqURe zYrd4WHz|1bA00!oPH_pk2J74=t_+K3=zRaBm)G zfLf^vSkuwV@JZ*sFHIE?f@bf>8fnuZ zl*rIq+^Gg9-)~_g``A^2hVKV9xpOGUmPxxiV^g1zJ{r$`5f*-4 zh*jFm9|>ri1Ke<5d3ka2$$tl^Q(TTH^@>B2Xt(vFj`N=@XLbT!Plw>5{sCpyD0%BP zI=+J6X1(BP`Q`4ZnJ8hO-$G6SVUu^pKkE#w!1z(J5m7ZH&D6rgA`Wb0Z~}VLjIFY} zw}cuz$bYfmfyK&iD5bI!7JwOkRU>cTf5&OH#pIiY7AWquAB320xGrXbBO>IalFRts ze4qsR>gJXPH{Qt5=o!6whm_W8Oo5s>n(mp=?1f)o@+EZG5m-HuY$^O+K$rIC+rfr; zKXWT6(QS?cM*pJ*j;oN?i1KLY?o)KUEH{9=YBThKKjw%ztkvhY@iWF(N{$(V^3G`d zARyj@F$Md}iid{ob2jQsZ?@yN8T2SBM;A3v6;;DFPJ8Q9y9T^NBUb{}njq7e3Y8wA z1J15+ik($-xSwrT5e#)dyg#AXA1u~8)-*k!!GCd00ssI@A3Q{UXvK6utE!75;L6wq zbeqTCtvj#_?JnX{F}}Fqv@SOiRn;Qko1OJA?Gj-3iz?shTo=t9Kp>zh z`iJ=DR)mwT0w1Q!)bvfkUe%gnZA{Fsi?~*xcbe&@seK8U-<%wh@B(&Py4Bf6U9tc# z%cCjN)`t=Tq&*AytN#}H_2|vCW;u$r#dxj#YEB8^#D?d!#Pg#;XoN+wnOkEis}r;9 zJ${lfb|wksO3}(S3I`O@P_H9zxYYm5EP;gT{`(POUUO6?9e z$?*uv6?N_YKb7m|Q0=^k$aGM8~EMbEki`M=a@IMNLJR;IBmW8 zViSNTBUs}IOhAnm8m>t5$eqA!}|yw^U^!QOVPiZOqkC24#R zQ6%Wh0ui2+m`k|{$Uj2&Hn+k&l>8vwkJ&ig=I%HYQJnENeTq1TC%&fDd$Apug06fR z|KfT>8-S|u-~v^A%3i-_C^8K0PS6*Xdvn?>a-JwF@s@$`*Ux;@6$gu}^%;7X(Uk9N zV8Wlal+$7gczCA756R%E7qwlj*d0*l zZ@QE<_1Ni?RGI1cc2oxB=VU~9f8RMbOm*@cgfm7W-8E&hLh2Z&+4XdNUBP9TZ(i8? zU4m;)i%(}G_p@i5*^cJyQF;3(XAOTmT66faeDG}9&3YHCWj!Wm{LP-I-$j!?pJ^4n zP>ho!y&m3wh1xT_GfL_#Iq8CCdARTVh<1JJC9-CNP;_FF*X2)BJT$=4-YlVUmSZxZ zVCl@Y8le^s_3=E(xUJMuU%awD07CUa$xlhuEt~z^!uBus>E{wkGBaSBP}ZrWPD8M} z*BPRMg$#s0jp?nRZUqPHXXe<|MO)9?!RuwLo8{4uOI&ag%V}^qYjK>rf6wL4??*&v z_49wPloga{ENF|k#+=*MQ&^1nlmN$Nel}dGb#u!vDmt{u#qPyK^gN7qp-_F!XOvXo;Q3Z#Iwh`^#jwIxG|I6p&x6yLX|+NJ!SIr=-mx+)7ge?{!K!4!z(yn zJMn4^i}#}Z;Z0lAQ%8yQv7;Ob_~kQ0YUKVcD~p1xk7B-GU%MNZ7uv&aH*g>M|67}Q z6SUeWHZP)$UK$A2fcq|xA*HG91R{*E zm3BeerImrF8BZIf`4@Q)|9~`pG1sJj$AK;Kmy0T~q?0l0ABIu)j`PVguOK3AfFW=p zhZouY>Cj9BGu3U-F0W0OB$LIYHr1^*ob+ekk24l~)_b(lrdb=h_iW0?CmJ^Ss14Lo zB}0g7SUo5dc9d|`nic`ysH5}K9&|)0cG`Bt794Q0GKWX@a4Wwq$ZDFuK#3J58#htC#Q`+n6A zGBK|OD|)1aJCVa7YNKkm%NfGc+U6ZX1m!NsuDtHXkyL0!&cAeF2!#^GkbESRdULCM zr;A{e6N~n+; z?#)6Kk)qfqx*wJL6mP*>azqNy}S%=Z0l{=q89 z$qn?7A}zMAlzag?meH zka4eH4k|UlN+&+;qEJ+Ebj(qe@fC9<)n4)36B}%f@76YM#!|BZ0BSAOu^r)lQQhegHC|dL-LkOY#DAm-8#LR!-KQA3F?mVS z`JrsE-PT;UEcIQ%`~6ZTe?lz*j*@dKhygOwGqP*ys|Z9eMt1D+Ur$STzE_HW#bAuB zAae>1>Ji1G6zI`Sl(V}7!2CpL24H4->dr)sK?^bB?O=M(-uzO>I_V1yD7s1}QL1FY zEnXI)E>SK^^#ZfoG4r32rFoNN!S95f;)7CahH|7P=jyxbFRBgTbr_Dxre`9K$-ydc z#7#Sg5srRrN$9E9pByikmF#YPSlaIi3oRR0EgL$X5(O)bG;7j+DCyz0G2zTdKR>!AM1BoF_+qT26Wks;0TJ%fwE%vOB3*<#JVush;L z^mH-H*N<-Fov4q^0lc$liz3E$%gI86&p9Zml`vFXZ#pYr}aJCc}sguG90Z1aJHYG*y~Cm^fQh{X|F%vXH9h@&yez7ifO&iOJ)|D{#i`9FG*B*z}_bJ^p-##VlxP+Kxw+ zIr@7+3ZZol70>HLJ9x=7uU9xinXBv|oX-r*raLOD8Y_k=^_LrK5JAr0uuMKUZtPsH zv)Hrpi9f@=$hy;91Wx3ak6Zdl@cBzYeNedC-w{t1EL4)9LL}66cs^*?61pZoP2cnZ z^uP=wO1=?y6L{@X<9#&I>t@)t24h zjY@P1&jYlnXp^;T$aailY)cs5kHJ@ZF&e+&xkL2|{O!)pw_v5qzUz1PSXO4!<0SNh z|8$ z+>JHyw-2v86`+;P!7u#J$m;C0W-*06c5L)beZ`VsRfs>>2j$8!+|Dt_QWn9L_0^9b z;-s1u^nf38=)Ptc$aN1>c?qjxF*Kc-gOIi@-gLjq$G$U9iW(E*8%r6d=iJ2XWS>b$ zVD%Hdo1YHh&W?~XZeh4C@T&M}Ic@9!*c}|sl;~D&qDU^&a)`tcJkl`XvTNKr%(<7H zWM*a{`nXk6z0v2+(_5NFX-vya*V!1T|6CBIF(#OvCxg}0mPj!4!v>4|@khYaaMcMY zm7VzsxfZ3N|MJ4p#)oq&Iscr%PRrUQc1@qM=(aNAI z4N@tYksNcpggM>liL0A}{L*n#lnXtPWx$JPFapJ=o`OSho*A*kk!XM@u;4v*Kpuey z;V+p)O_JJOxTrG4m3fDk_c{`7oUiVu)knxZPc|)zOYT!(Pr86pnHAtRYN~%0<<7#1 zH#GHH! zA9qYw4OW%-s9a-);9*m6p`deKMMgt%D?;%6-}p_?gu#g%gfvJl|FrTl~7*{~_p0U<;z=vQOZ7aK*CAR$KPn zoImRj$0!5eYJRm)gJJ)@+YH~{9u4q}g5Rw;vf4o^iRN_TB!!-nMfQaMIt%2FAYhsP z`~)4%$muD`B42C~Jl4RUs-{*xEaf-jX08PHY|}GP5)*f8xb3XSHIlqD{UyZ4aK$Xt zEtBymtFmQOEXuq<2T5OL?Cnd^E1RgelrTzrbL5Okyx&=MKPvynag-1?Zj8$|rnF66 z53u?t4B_34x*8vEACId*1JR@{{vn!Y2LqEI;4d_t%P zlyk^dPSHrrOp3w2F>dy(AAVewFZS8Wnma9zaZ!mUX#DdK~L8BlXs8-8Df!NCo zHzO)ca?mRWTG1NJ{=L&)`GlZu7fdBlN&Qwu51-d88NnHC^C1n;UwZ)ep zY3ZuYbs|n1F2l16O)*?2{At=LJ7CEnL!k|WW_kF5Eom&q*%|wU1!b7(OO}~jLqVD) z{2@8Xm?6T7MtEK<>sgy~+Alxk%5txxJ#Y$}HFDXwTjK^9RpJo=_qxMzynu5YB1bN?u^DaS=euRciL2jwY0Ux@!eSm`V;{Mux1O1w`f0}r~^OrWeSK3%n$PLCr(-byD}(UM6-?C(#dmR@W=c&>?p%>BbyyqGs2 zt{pV@KUmRQL0nh$9LP`sq4Ade^*(<Ql#b)w zXYOQv>Ux80=37aW!`wdjVAkOX+=6|N4|_;HaB+!ho<7BEo3|=$3;4QaOObV!D{1q0 zszR)M(WgMSnDDs4i&TZ>5eR!$g?lFi-G)e7M8!ZC2tn`!X31stQR1ogNABHP9XxLn z-F$PR9y>KkGQm@f8YarXvGyzI_gL*ntI8!0jPa{s{B;zCfjsD+X^!RPz|p@hp+ue_ zx-*rO*$1$0Ze2ERkeXZ$ap}ZavD;L{V1YWcXDH3+x zpY)h(eU+@xf|Ov?V_Lwu&l3ho2b-9ZTa@kJGVQU(e627t=K!fCpPk1jvpEhb_H4Z2 zj49?usvCV&nvQo6XA3=VE|y7@*M4O_xNuhko9%@fQ{1;KJJ;o@(jsrBO4m6?OOU_c z`6gQX9QkRRe6FGZKcyL-<~rcg(E2HBf}&F9bkGo%3N{V7;4vi1f2~QUu$YdV?OLk= zutfbbA)#?EC%Y6oKFam;>b74Hm@IcoABRaoorTTZ)6QN+QQ9*o&fO#v zcaY>h@N(Vx7Np0i1&{)jMB-2PY|)J)y3JB@7u(ifRAb0;br92#Vc)D}IE4S|sk2&5 zj~3frDrwlmG4yB+cXgX`3DIaRUSeW;j2a2tgNXzil z=(%o2OWCqV9?^-2bDwTKCD)Lx=2ZLVE7M!r(=2qr8q7bEMMIIdD6LmJIf`542zZMH1 zQ-P*$nCXPS%t>-#1nw)QS6eJxP=vP<>oDiqedU4+=%h}6wyO$~W$OpuB z#>d&d(^5iQXWu4XoCgo=!r*+nGn^_j51-6#(0G~R{g4CJxKj;+b%yKAi;wAZi7u05LEx>n*_@#;iO`$6 zmLCswVe`bte~>XKu;wEyF4LdJfS9?(^&cg!33v16Mm&e=;GSs{{odPHm3nx4v-~CJ z!#=$WLQZY#)Q7!)j3O461bF)mP}fUiFxpUt!PTj2+!?#djc<`oQqm=7uyrYeIM?S4 zMqqMGxO~aK@Q#6toOU*uSNqlFQGC=0s7b2hB7Xqp9=eZ-4FXj*Q>#mzq|_)Vl_EC& zeC~76Kb=V)H!U`KX%I>b1aPl?7E#O56=W^n(Hk}vblO`3g~;)_aWAGGnDyu0#+t7$ zzOVO080#~_$4uqOyrwBj=I_TLk781QI~yvsRE06h^R$3T=_ABnpKx3`#9*y(wn!`< z^%Km=f3sNH{i%#Xq)pd6txatFerpMdBZ33j#YmT5o`ghu`5hgKDYAanCMw%AaQ7&s z@!X3E{IGV!oUm|ik4R#((QC`1Ns?BE_16An32Ime=4l@c8k}dBw$~v_eqKsu_$z01 z00cKxLcBR>LmW3Y{>T`~q-aXnw5bVU!ESMT)iVu~aF5|FDw!^9C%Y4Vm9OqxFh$nl zJ!IC$bWCRbKm1Rqwq&xz1VHvO#XE8%UpYJ2pE@81Ai=a@ACL@%cQfH#*(Q5nQL07Q zTHznhFU>|YAj?DZI0bS-B^KICn)Do*6r1!pd|O4k3_ze~sBQaEv3xi+DH03L`{DgH z^6Ca?J(y_zyuv@^nPjZpB=9MA&U%=?p!kbpr2|{j;F@Y&)K05zWkQfewu<&D;UcDw zQ+0<2maqe|JldK8o#tm=71*nh3sy z%VphJMjwK_;lGO}-}^V{m8#ynFp=nU@KIY<&3YMbvRUs5;;HkkolQO}i8Uy8z-~1w zK{Z)|Z-;EF1vM2V1FJX`f32?|WturT+isOm2pFY4j5~JCj|3I3l!8GtiTve@Tg6xN zSS@XuqZFYQej`T!45hl=-4l%`5?AI}a9!NSsMdpN%nsSa=sg_*3X~YPIOr&ZUdrR< zG@YQc5T!Z4aE056^!9U?rZqL>zjAer>|j8Ehk~Nwox-AaXb6o?>3mfCZk#IE;6!j` zWror#m9|2VV*sjO>wl{r&U#l-Q+?rDLjXK3vo?Ag2l3}JxU2}%iyjztSb6pHxO#Ga z2%GR1vBALo><(15MBo071lYhST6gQO1j!WidG=(=Ud?H-`oIUn=_H=+u-;+wmS_x2 zK>kD-Gh9-XLW3TNR-<~51fao{xP;^w{&)dgRJ3{gEUh(g`}2OS>N?x5q5HdZf^Rz% zA{4J6Qz~inTD3lsk$;Q(KA+(nDR0!Df5Ig4g%kH7{!sA1`h2-4AKm@LAP|-MV=G0& zh^2uz`e1lHqK~7}E%~P@r`=FcE zpN@#pT#MvVm5M%eC(ab4x3oLJI{k37fOKvZ_}@e*Ir2%FMJE%hCeGj}kiaTHiVjr0 zR-zNOocB;Z2;STY@+7gqk@+~IwYsWx`)(ju~Kf!y) zzHmdXK3%!KX#%a`SrY80X~?1c|E{ZKZW1neGV~s^d9S3`t*bUZws%TJ-2a-o{`xq=o=>MDbXog#Zilu|wMmgM>1xmX#uHO?uh9 z+Zte_gJ;5VLh;+=GJ3qAGu7kW-ejM!eMKYvukrMMY*btJL~P84BWlpS!d{?{wUTgl_1C~ zaiMy72v9I5z);oGH*c!lYPGh1%`GFwn%1mF<&)%vM5`dowgLOarZs!0TVua;RnUC*A zup`S87OoyWqfjK_DTnUJHMC!}1s@rX9o#&JShz=Q=CUU;T!Z?z=@N5wc9;&h9ha8g z$ORB|;Sw~R@fqa8Tgq> zt!v+c7u*j}##)-k@!{PI);85dciL~Wy4|E~cu(vN4;sAOg(#BNjfCuB~Ja(fz}C^?q{`>w3QcbxEa8DrM* Cn(^KM literal 61212 zcmV(pK=8ke4Fm}T3R#+pKmW9h=>O9H008d?0b1i0#~ahtz#7+itSnH{Y0nsv+o9jj zT`w$L!7VI*m$~>SO*>j%1@i_;e&vu|mW+KsM^WE5{@FTCU=bX%{sI!h3UMsEeRhET z|K5l~;uB}9av7_CYui(7_)yM56{c$5KN)Id>+w*zUp!0STU3)Gg%lW@Wxf|Zz(HlD z?=}Ot|M+V=5@ny>w?~`Fsw%UT?;-Jo2bft4?QxAztgMlq!(AM%#!sHZFOxsT+2t4Q zS#s9jd>rvdkq0rtB^*WVnOfC0m5`0K$;S-611hsyUD!XP-UE?~mYl^hcP_Zs>c{9O z<$&sdT8q%|puf3WSz+@=9hw+@3>0TjywX|O7~XJUfM3?Rmca_xuhr>|)WcDo<}4gD zh~o|F7ceb;s$|Ay&irKgEw`E^eSl-uKW0Lu-O6e+0mzu`3Hl+-yspwi9VSM6Q2JM} z4%B}M?E*4F*M=UtM>OV&<%#``hu!HxWlogYq_xGbP1;uOYc*1Vy##`*4SYnN)MKKw zD}kqvxq|1Cb7a_g!6fT5GpSW%q3_z=0MaB{RJ9D8&yPE4ZfCeFw7Pnm;eh*&_u7(U zG1$B$$>5&LcB8{PY9IA8{GwWzha1OWyvJ{iDOyS9ORCodjWT|RVw5R)Y&7PEVcffy z>M=Bsg~6_|?2Y6cN*_(v(>INGXcl`HGDqKm_1O3dhMqG~&cS-1u*~$(d+SRy8(W8; z*$$~YCm|8n=7a%w<|eo4N4cRVC1eG@3~_%if_r^1c|5y_D~fARt3Y1SOzHG0{ucr`cr2zkrsp*-Br;QzvUyWHV307^12&hcyCdi!zNc|Y`5q+F*Al8$dx@LEdeOLqgCPHNX!lu0m1H&L0NFWV5Fs@%rq_cADBpnxzI&62xzalO&&V8F7A$ zu2zW)A>X$IxBT#MyDMr{THz}-e;iq3aVxL0P7_!gXXb1kJj8npmyUuurja*K&t6SF z4zB)(ntvFWa%5?dM*1qqDP%WB)P2%7r5uWER#h#g6^(`@)NEQ+mb3|tCe#})*CNfZ zfnB?u<2Nxfagai+7C1dBgpF2nfe-WHUz1lMbuz};+Xyti1vtu06*@kg&)m?dN5d2C; z8-_kxHiUo|xItWF#Vy%bg>l*6?SRZTIRg>=6Sw}dLr3;<0d1WqZYJwYTtI(G8~7b; z?V-*Low|CSr=)<-o+j#vx_bM~k8GqW&Kl88$)El~M^ z&@DjP`o$8uo)#1XEH9fL#+e1Vf})fde}q-1WYl+4QLkDmMLg=5JA{sDvnzS?W8y5} zjJ(Wa6Rpl|bWGrcH53bz?P>=u3dE>Bk3>RZ5(&x{a%NGX+wDjk72r-zA|hpqq-Z}$ zr6dmR;e|rP0!QevMaLAvLC5IReN&(}z*m_|>bVPdH2(ZbB52|dxoISclS6B6(&CYd z!Np0;zi+f^CteHr6nlP~?XU^HAvd(=NxlNRT@Q$!5DpA98PR~G5IzuGT%ofH^2BPx z5T461xYWIUtG1%97f3!33^&nP^85vSd5K@-L|=5|Z#N6das%1Fdg5jL`YTwAyMYGV z5vu-WCb>(E~3YqXukzGk6fn z-Pht48}WO|md8!2Di0Q}@OIe^KKe(|A$e(wMU`OSovF9X%9jJkmNDCSsA2$IyAi^| zeSA`Ae_I@$|8+gmVg&!_E(dVI2wmmCdd$`~+A1A^{FtW>-yu#W-h6^e5676N+IBIY6P)ELT~!F01Dm;j8qr@jk_G0jAr_40b|o zbrt=a+*qv>EClCcg>YAH#jvGR?Wq7K(HEOivJkdDRsAI-6c{Vi=G@7*7QGV??zn5O zQ`5B?xj4M{++HZ0gG2V;r37a3Wau6xi?(+}I*)_DP>cwAsKP+-Gp5QNfFTI-(5HAm zb6=t>TvxK{yGobX#Yhwzv!+{cYOA5Ld;C3vSy2Dtj3#C*P?v9NBi)Ec(dqL z6?%Ibkgr*(n7h{)?rXGaqB{s7vB=IO-g~u!{R+7aVDLs~v<)#LG*$JUzj7dwXs9Sv zl1dHCn$gI!q2+D?{i|0n23N<%IAZuhwl9+pmo^zIW1d^0C6{NSdKl1$FF(O^Zk`qK zg}N7ck(V2o;q?rH=E|PKPm0Djy|XrQZU8*6o;GtI+oV>u>JbjsJV5`NkR>oF{})w^ zod2kh2D{~QTx#mdRw1}>XO=$F(eTX^+7;y`6s6shPd zm^Oh&zGiFohtuy(ft(E0#DY#jn(w~6X_2KGVBqJ{4d?o74%9m$w%H}BY7&XO@N5C+ zYjO0s>-UTrx!n`n`vIWOLg7P)rp z)l>RxG;?6ilZp+wlU!G$b)>qSKCv0lW=_<(&*oicb9!ohB^g{Ui1FO4DB>QjhY2O= z5AW=E32Xn&LmzU8*M4Wk3NU^~AiCk=N5u78CL#kuum*XIqF+<9g)nJaY0JW$vg6WD zx!m(!Sf&#>?!swM2~#v6IzKm}zS3aD;{ z$bymnEGZ2*YXW9&ff1KGd&bK&el+zBDOrAjrkl0o%x)bR-e9C<&}V?xkTvlf|FwE( zeFT48*CgMiO5Bh8kEK;3w6e?nq&2ZVEttc2p97Oyw$vX4&tglWxk4iujyOsDjb9T3 z{0gj7Vq2QpCByo#uWinAflk!P`rJ-XFPZT?UJum=bLluMWlxXykm;76e#qb0w+(p~ ztkb-~9f1cM43##0jK<}}ou!$Uh5t?L(vHE*=dG0yS!%oF@8FwqMGqTCeCh9=`!Gc7 z;j;ok^%$GgwCF;pa~c(Kd)x;nW{i4~llJo}5)HUamo**CHh;IXrRIAQjbNhj>R_CP z<`;tKBk+}b?AK9@JI&a&kt?{1u!*|01ZzwiLR0)bpYA3S5UsF>&W$|rjj;h~<(5z; zfPmcr26Emg<%I$vcj!;CuZIxsAquV;6NbdGYP9-FnlHkb*&1P&dIV=$@HOdjqA|A& z3_hWJ6aI$D7*|?2N9ks&`FbdDrdgUb7kPaWS$su3|?Z#zaT2(MF7-uh{} z9x6JYr9-P2;TR|X@lsK3 zZiqpveWsWhNn^)k4F6;&Ja>)V&8w|CrCWLL zjoe}PBRIf?N5m0W*80?B`|1?t33a_}&Q8Y> zmUM`MQ1^U44%q9@`TBK=7uV=4Uu~_jPUl(oVwEm) zlxdMoCa4QF5*K$dig?3(ERc8UN-M#DiRLH1Pl;nAm0Cf$Pm12EQiktkF=Uad#f~M# z(I6-#)wI{d_+HFWV^fbyy@!PSlyV_YL2n5ANQ}XB9U}-((O9zd%uwHGs{qev!SP28 zn_yF_l&@RRNGJJzYXEpF2X@nPmn58d`q{jfN+2MA-u5~RjEM|La-$`cA=*~jvUuNz zP>%+8TMEY^y+aa>SIDzZYAx3HlA)E_BC7H4mn~neCRCO`_S6E>Hsv&rq2ZzN`1sy@ zg#3=c)3*8{T?+aUcOb*&Dq@cjfXcyvz4RsiQF$N=cJ8|FZD%|$oPL*ZXNXJ0O;xRQ zlk7Qo`<2Z3%KL!9Ygh#0jHRh;+4z6?NTIRS`bO9wQ916%4Tv7+T;gioK!CBYRu8bM zlP}Dp!ML6&ZBj7>)LQU;#{Y%VQK_1G1gC+3OWKP_8(sD=UNE_}vNC2ZAbTNz8{U|0 z8-W5!HW1@tkE73qh5;D4kVBHKHAXLKp35Cid0m?~G0QI3p#kfgd|&TI>^(>+#*n`V z9U|{7Fnv=Gs%N*D_6oyOn<=>|X%gv5{7TMA9Z%TyekZSDGDG9QyZP9*V+V;(ZQ_>~ z&A=MAx)$&TLu5U91;~h@*2DLJ0nh53%cJv%Z-lol0*Hw6!CesdS(VYjA*c;5bi~pI zaUinwFL#=mdlfA2+1mx;rf>U4&$0|9D(wzM!XsOUEmAM>H%=QuVe?=;J;2S&yfJv(>=@LO?3$|3~Gn!iQ zEG_lPn4;#?x}2RG0^pKkDHO^|&cZLOVc%vpVotw{;-Da3;vgO~iRtg1(J=t0(YL`I zQ;wfwWqDBs9M}v!pMf>D@l81(>Y`=@`wAzf`-@LV$xP77t{JUuG!;9PP`zL+_gy)d zVuP30oHvR=j#11oMsJ@Dz?B5-)TBUkgPN8hCirYd4(q^rKSp)`+)6~XqY#t5GM4BC z35+6adWO&R9V8CxiYVX!=@Fq$BcNZzD!>-i!;c=XxPnLrpN9rZe_v4&Da>T!=rAFD z0%5VB8R{?R$A{GD9yH9JlrK>kVIor#Ge|R}x#tIXjQDW%ete`m2#zYmoT+@lnIJ43h;- zk@FYFP1n3oVyrE8{QN?U)XW)kPlmY6&!PmddOcx0*8<3?#d9Q00LvFY`5R1K5+^p_ z(1N7=VAHr&Vjnhy5=n{bH1_6FP!Y(*gPliC-Al5YpLAM0(en55`!qGgB!=zSy<2g z#zCW@PAC)+E4LV7q}uz?wxzC)`*Zw2cuEorTMk&XExM$Aj!LH!s{%yOmwSw&|D$_V3bzB?EbMWvw1UZO#e8PYzCvTVWheI~C(DWA(E^lH zL~;9svEHIsD{KkR;|;tkFm2N;R_Ow$(s*~zaT%9o9DlMjN#clSRhQiRyiX=O9}SkT ziIWMU%a){Wg`}AIpXODO7NR2wkQy6CW4NFpKNUem{{O}HrQU;}<&v|_QdP)yrq~Dx zfgj9L82DidF~#3QnlrA5gm}wiv`Hf(V4K%aQg|*2|4W;fnw;8I+e;!#=e^yrw0Ct|_RW-IBGBJitB@DQe&=l+Vl;b^mW)yf^%A>Unnlra^HY zzLJAwuEzm!LuM~i_*HSGwh!KhwSyXQ;l8P};YHGO-nWn0>uF4ggT)kmSm{mRuJm2` z^4mVp@bg5Rdq*3w2^x^@9MSzmaYwCBSc#quY?K|#Xf4-|=6M$>s^B?qED9ezY?iq1 zv^=@SR}Ld4@K0qSG?oMsci&xfNOGAxTZHLDtI)lt|^c*?_u&gK`fx zFS59A~ZJtN6twZqt9Lg4>8vU?yVGD0` ztq-a}OIp2IqWw|V#jL3hNXKPZ?s;iXb`4rK0T&sHFa+bU^2V}kxv5LPUt>TFE`xD^ zUW{)(k9UJ_;p)f7#y!2Etv~hWRnv-C`2ocw80uJ~bmsjClI%NZ z$rt-Wj8^IXbfpUI1hnkyw#L{@r`Q2#l#M=DzYryyR5OgsI#9l2r`)!46lKo5=*$6s z<;b8{cpTrAu!PNehF_K_oDajs;c#m}W!+g=a3f&F1#O_o)oQgD9^DY+(a3={u}U!- z%n1btJ+vrWxlzF3LcR{MoU1kp59!g};j2G|mD0P>9bv%cO4b6YJAB#8_eCQG1O{50 zk`kM5abVb0e8PC0r?+m+L;!Kf-`Lyv!L@4~Rz_JzIyiad zyaQ9(yzGg_mc$!MrO`7oZAqe@V-TaUTTi z4OQvMrp}RmxO*HFg5k655`*2mmfUBTQ^8WSut-Uph#JMF?)bQ@8ZLvX#)xA|q3dpK z7F3?gXEhSKm;v8;ysQr9-X`n#p7w&IFwpY`8UO)v@`Dc{Wx}`{D^fUgDu>uUv3ETEYP2zq~b$ z{>(=S)#5}cNx_0rHzgxP?emMuxe}RuKXXC%s4|ZyG3DC4zgJ1(-p)2 zOs-zuUpjHO;GtkCPIhrn#YdSZyoSJi2Anf*r8uP&bVm~ODPMKbJkfCKu#akpH3)3V z+h<1Pv-exFkhs$>(l?^-B5Bz9hF28FQCK%LVy6dJ65>a?$hc-9La(n@eb#zMX8>dn z8Doc6`cdFRH@D8>y6@H2jPx4oNl1|9qk^XScX{fbaxVsO!U-xuqKO~BAj0)4- zi~+O~MCdfU<&!*({{tWz+k!!rUP-|#@ewF4;x%oJ3H{}wh-_Yl@Nt<7f6ZkV5~kRG zZjFxCz|4rdp*JWSk4zEDar&FrOJzoR4bH>@y|wi7&$g>^knL!tNv`9x%{ce`)%yT2 zcCh90WF-RpdlRAbwz9sAacBM9$ZdyRpAa`)-1}cZj&u^7mSm zDjn+y_`o2lvFwqUq*Ygv&pfO9M;{N4vlG zN2TepY7~L6s#TF_lA4|D4+y9EL;PA>rzCBny)AzxO!PdK8sy(QPUrcr(F1% zDC|RHi|*AX|7JO8nKb+FAVlK^IsAEewz!F5x>RLB2MZ+`(j5Z(Eu%d?_t*s*Z zPKwfR|$D_fI?;GJ=F&QtcnlS!x8t2DNorkyo{fZE)CyaIBVZNkKgoRDOK1V zn24-LzS*h_QkoF_m;PN7mjgh9KJFXAy;-l;<$mNS#1oG#lVT|3E8v1}+fH7Hnzm}U z-8v-eO|-<~&)dZ-?acJc57#dPFPUGl6O89=K}v&#kggiRD^a`;x}w&T#fCjq+5?u; zJtprq67+tM+r>B?72lwnbNTSNUiq(F>WPt6gmc9(8H?*oCSYgVaU<~9N?taNlop{> z@GV|opxCP;6?sGOxCYPFgVE7tzB_*n_YwH3(CE-gkfDv3 zAkUt(+MhF&R5Q{W};P! za(ghsrnjC}o*P}r%>Ij4U~sq3>jG5^K?za=fo!Kmsf*xai@?zQjj6w%+@aEaQB*{Y zfMcj^FrzDik-!)vn>I z>Bgek5F5<`YS>-*3eYmL;D9~+F&!@j5$x z%|1%W^SP#~gAYGQTI&DGX04{sEH%md6!t#P=`%Yt`9z(cO7N*!O;R4em#IbwJb~9z zLY)p!s&xPbBqjF1KK=;LwyMaJ&~d2Eq?K*&=Ydldk-{dne`dM)8r^H7F>Z;^W8jSd zntyZnbpe(vdWHoXHm-=t_brwtpVT5K_6ii-d;^Q_yzle>)l{fWi##I%>5J&P3JnV- z!BJFLKFhZKM$k5Pq!4D#=tyU?Jpv>x3M0MqV~@~!@ji%z#>tYQ7P;Owb->->9TJbB zw=?Y`E5ZPx!oIJ0XGH}x)JzKBQ2C(-ycGX1O(^-8&zQ&~l*JeLGHVMH**m83R>FXBnQY9~(UTogPaLclzbkAZ`s-5lmE4p8=v1hn zGZ2vP%x@ZR?92wef^uc+sGL=!QpD{c@u>CqzUNyM>IuEznyid`HDpMSOJkoF&Qz>E zXb7jo3#^*>;J(;Lk8n?BT*UWs77{cFfwglj889jw zN9%n{r!!o^o&dT^C?w(4(`DRS4G>yOC|(gq zG?2nXL6bU;g}6C)N=5U7kmI2xR16)iDA8KX>6CtE*$A91>T4q}hjk#mjD z6)fU6?`O&%Y6SfL%iKdx%c~7_sUOgfVk^RNV0p2Zv!_Ji)VRij3WKMy6$|s%CF~r* zEDC;{2znBop1mLTQpe&sO=#0>V!E0LeUM~$eKPW+LA-k8t-&)C zuR;%(&(yEYyy>jsV^fz+CvJ;*oJ?*_VG{6b;R}jaMwT=wMzDGd_)v>G{yq zej2<}@NNB;5tPO-s+lZwpF*$yvpI|UI?Z2GPo3pl7PB>AM6Y} zEM9a0v0wHbvm=TxrtsA9m}UDabQtfBm@@LrT5jE_hs}`fDu4d!D#S z(&c!_^#*(sVJ!+a|5T6k@c=y?LB19k#RnvSthg?UL?bWfvK`1EpVUQPFl}r!Y(cLr z!;#NLF%Y?sx2Wp;>)QzFyuu8`R8-~eERun2WUmI8+PJIM1|5C5e0VvOTn8&I>sULt zR+AMgYae~uV*%1zSl}Qjlm0;<&)s~fyd4)tPSx&LuhrF4>|&66FO`w{b&1aeA__;W zHl*N6Wk_RjLVG(v`(PPSDVkK%!Qho~uQgUM0;SUMFV@| zm-d~g1?3Wy)r2aG@%lum)1{5Od#b4uWfhYE+XFf^iPUCfpYt+l$+#aZLiGlR_d&ES zcPP(4-h)RmR10EiA9$Py#Z+>OMFEMCaWHU-GB<;JLzNNr5`v)r?J|LoYQ^LUoUVKI z`?-mjy|tPyYFLQTE-jt0sJ*f0o!XM?9Wxp=r_ zRUsS|VHUngOV$x>4M;r$CklF?i%PF#PxFcCn z;5g0pKfkF)0I|kzzLhSe|zQt_RiSH4HG=7rYTPOe)Mz71)Oc_+LxuJdXTjzWer{4v;wJ z`p5*S)w^D#&6k4p2=F%6iE&6h35ItVciRn#Ul-@zOnX3+xuldJUwg<(v*avsr~@o- zle{UYIa?eAQ(6}_s8uE%VeDvY)E$dDTWGh{d$`dux%{P`we*`2ba?Pa72cxOlBQY8 z`gj|gA1GhyOHe5%Im<{#+;eGh`k(BcrBABS~q9}ZK z1&*d?bHOCeub>LU z^DMRHtfP#;^N7pE$?Qe#@joR*m@G&{-h(CFNG z;e_quHEnx8{xf`-Ijr#Uryy(uFG=+~&Lw6m7%Zo(-h2~kteO?` zTp3l-2ArG7^bCL;5mkd*nPar{M#bf?Bu;w2ovx&PwU2@jE8zrN$gf&Uqq1^;lUF5> zK*vVO-6?ctQ?G_>g||(W5;CKWboQ)?Y_MD6>;MYoCEVCNw3gThcbw-(Bd9YoXVgj> z2tn=)Y(FV(%3>8e)Pz-U9wnUuB_U%wy19zz%I-552A_xAi_TBPufD75A_GQH;oXXxRg63nH~hKgx(xb= z0mavm`%0c94?*!jlR&hRB?=lNyCkF`^mu;pY%FJ&s&pge>)F+R3EtUC=lBR>O?TCQx&Qja zq3&C$GpMraiqCsMoIj@1c@Y-*M``}<5{3?USz^*tObB%6Z#Tq?z5Q6qCSdec9svsq zsIdYYo1+T<3+EE0oOY3;&z!LO&|@8;qg2te#;qJlz51gvUqdP@DL^Lw@hb=FRIj+4 zSx=Merp_&)J+}n0J3o%{AOcPCxWTHu_AehC6YL;1EA@AbM%K`RU0JuBNYzNg|IIHp zcwO}=R4xvna(RP=5L@lg&5OxYFM%EHal88ZOD8QTK)*Pkz%S~}7JN)n7Xx5Q%7xH( zf}L4-U!2Pir4L(su_8HGT290nz~J#BT~ag28O zl(1;X=KwNQvu%dqR*;>#&-lY(56X`hd$5ejPxNwq6Z2)P!goKeq|?sfmYdRo$F8fb zB$*U&E+!{eoX&GOrer!FZ_|x*BE;h;xsO%%?~UcX7Oy*xC|3Tm_81l26z=Z80N&&QFWW%wE*loo)YwGK;`QobaOP z;|=H!TL&zXhN_S8?j*CJVHi>d(^^9d$z<8tjP+QF_)j053ZDs7S$TEXkr@{@2 zK*fn@_xk8Pd$D_^9x!Sq3Vle&7bGc1d?)H$4vOI=O+<4(D5GHV^B5>pD-0C4h{hm* zczG%9km+OIT#H@!e!A)!RqiifB7!IC2hZ2SF9izBBR}fq=~8Vg&I-8-`D>r7-S;~dDR=-JCcX(P4VbB!a5D{t5yN4DZL{8hmcHl93 zn+aPhzg)dYa$iK-e?tSRa6r4Gyj8;CD9g1G67mQ`+sHs@=XYB*280`ocYNOVvJc9?lz3c)kVX_X}BIj zM-A*xd6- zo26+~{(oxeWfvFZe?hp8F4jWB4G!iA{$J4k69Cw7r=lW7~!3o7rAmD4a!Z|~U zGp##(o`3OTia4oW(ek7iVcadON?uS6US|Q4QEtn(kSMSUZIz@Mu5xLVU(Q0N3vz@5<-177wQ^uto(N)!> z4FhJ~YP+eKtEL}>U)rtv3}YysGYH7$dT(aif|09796PLDC<(&cX+uxW*Ek9GK}z!! zIMEPoXln<0Q0omnQ7fO7P1z3o1t5}=tnfnSrD_XHA-%w7(V||_K-5z-U&1TO^cDwi z%oO=|e#l>c>om8MgF|!ke;nyNpEm5b+-C0;4auZ+g4E_}scSOt!pS2>?|oCE6RbuRzGe&b3iBss6i&)4 zL<;J?!ZiEjFG>njSlW6hxWhY+ihDuPyRdh%PE&%Mdia)!0_a-YYlgHqkufh_>cR!P zYEWzlD};7|H7!}LFobDgPQ~)uJu&v*B}LvU0L{|pL9=fLfDhlsNW3f`uPdZs<@4(a zhOO??2T;)i2Lnm7mm7^gwh_$2;)_BCqR<|f3Jjn=@UTsPZkYL9?cS_BOQnv;9Irh} zd7rB6?hdl}tm9NBQG1J2X!PumiFx7II6DM)yU7Pikm67K4C4~Ca;sKMQjxP zc2HNYG}XwK9xa`PzHFwScRTQETjui$T2NMTiFLS7ljxg*S@+|<4T3WY;#MAmdAH|? zm|WASyX<;gXqm@cu9oWDN_jM4oE6|J7o9Zcv;ZNRTZB(w@;~hF{E~`$(5>g>Bw9mh z9YD_l&eHC!s4)=i6Uyz>3bS2aNE&lxx|*{_|27@oUOz5UAC_J>BejO5=JR~HvU|}2qp9t)NI-|y?v|EteH4(TiXdiQ&54(zN z0R0KNnzzm&S`=+H59~iR7PCbVp^m?25=-9rPWuEfXsR@#xZ>`6uN(zqA7&+qj#0?^ zYo(X0s_>g1wDepMCu1=;{@<1PW)l(&6Dod18Uht?s*X_Zdep&S9K7?HT-h*f7Eh)p zl!!M=%}td7vQy0~9~IhuH1#%;K4iWwUZ;rX4;N&yUKvQ1tVL(!M98|Ww_q_a%bjaX zdnva7$>KAg?oE;=QcIEsoB8LKWr;IIQ$88m!+iubfDsAa_D9=7L9Wo7jv0F^=d7L5 z+YO^aemJRnxFK<2i?pX<$>DS=*$l6}90uB8o}y< zti5Otrv@7Se`O1H++b90ss2!%Xw$E$@l3&^@GnxI{>590MXBk&#Q<4->|KAZ`Q8y5 z1CT>=_!~URJczXfDKHf>JxxX184YPTa-GWNf5 zOG6FFA4p7+KhtBZDkiGL=g|Oo1c?B;$4geA0h-_qvh+U_c(k6CC_Kx8xvc zKpAR>Z?EnH>PZskLm-CT(gNTK6!$6N*r%rWa@C!k>IR1Jf&G<6Wfbew%j!^i zq(zgg@JT}O&p-(u99i;}?8g5k*D4S;i+M#tG}W+*^D}byQ#RfR5^DuOuGp*B9r!>s z_G{P(s8pQAaZdemF(GFZzhlF2V0STU4Jg!_CFZu(@oD2J+N-Ypts{^%Z{@a>ZNk;Z zsmaHk91S!7oTC}&n4^=bcbv9a?Q1-GUCc1YRnsJq5Xr|VWF!cs1$Mgg&7COHjHS~d zDMut+aj7G0J|9k6L&*ic<1xdLPCcbq@f`@D=41)v?P2+h*%$SQkc)0OutM#RWM~zB zXW;kx9EOaNt9!7-CmB^+;IabZ6>8sPFLvQuy47LWhfnX!=^w(FH=C2f@%8|SpWk_D z8_zkSRCq{TQ6736!4bhkf3HN~U`ax!`DUHTE&Y_uo+-OS2*+38n(l8G_UzB(tt0@l zZY;T@l@m$F@d}W&5px)_>)QGmNWS+4=ay7lFj|ZORa=dP-Jn^Ys}G>ztKd8*VQ4qyk5eHXx{Bz3-X&N~Ci47PTpnod9u$<8 zX0kKqPA7I-&zs&rhEuX+;Cb8k#nbrvau;RCtNP#a1N_=Uq`42(OZEn~7sbAih>rYV zV(Q%pHl2aoc${KXC^SE>@!)otOc{)%d@@uN*q{BViKJq2F z@i}K`rSk$;60BFi9Tts-#U|#kxS)`feFTJEvOw|-hj3?)el#V$h5w6#CxMOs$oap= z08^AD@*MS!Nxd{t*m^aEreDFtwiqCDtl)Qngg0v|m4IdBKdSZcKwcL| z5)-50cUd)QvS{8%C)+^duR&dtHQUwvl3en;D#d(mXr!aPHlO!0}m0N!B2W$Kq@llXpbNbTD)C$lvopcM>!Fj-RO; z?jpq9o)*oO?2yU(sc8Ik(O~;AVzAQL#xfNAcvqg5QpJ39f9yLnM7IOb#~wjj2B~g$ zz7;<=iun3aJa;KtiTFb#Y~zOFQ~p4M@G|)z`;oLRj^zRRFplQ_&3^A1Q8L2mrD zj@hiuNd3^k7OTFT4Sxs}I;G{LT8k}lhpfl<3q$dlx#dyWUd2~o;43rn+FK3{Y+{J~ zN^eoO`Iqw~FiICO^1dZr#^abXD-IcjZz!^e+qpg5AQqU*@vE127J8wR8Y9K+C_FaIYe4VN9*T23o(?`IPnly8v<3 zi8#=>A^5g!7K<-*n@gbSCEJBx!XZZwK*#63J_8>(*a3&E$^#xh8Hw!C=O^}UJi=XK z#riQB**Or_`h3rak^9=mEBB&L>5YOQxE$d2T_P)hn+o~!`?E%(j&DBp)M1SFve9~7 z_d9|0ToZPgN;8nq(65JlVVe6Hu;gR!lT>Kv;FVgOw1}|U|7MQaBaMEEM-y`Bq*B<^ z9SW{8&I8;gadux(fV3H&8cp50Fz(%ti@LNm}aq|d-Q+}+!h2ib=@<@f0 zI-x?5Px75=SBeCC{?NrS*8$+^0>I<&-JkCQCjMHO{K_537P@l*42^ zfj=ltct?g*NwxIyo;dHi;2iMG$tJ0>CcpPG!j-d5mov8kP~El4HHL8QXDm;h?F-wb zWQ6E^Rq?~b({Z&v=^a)7`~T)w7Ftnoy&*z~js`0DG$df6zmGp;N%m-SCtdf8}WN*()R z5ji^prYL5Pu!ue-P3j*g$qJJljtyR50y;+~y&O`J;5bP%wg@Uw@dq4NBC6HZ4I#yM z)C!jW!1%~k;V^Y@Ap+12C&V-Ns20j<4N`3hlKTQ1Exg0vbB9#uMjsT@5x7dyAY~JY zXR6RA90B2Zm-eiU34H{7F+=J;yWBi9^g!b2E|5PNzVtf?R192>>t9z3aswZ%9G>@Z zV1;rK%a8L7HFHvpCYxzNl$WZlL1o9});sIlbs)$jycy`G)ieM%`UJPibH_n-N4$9E zIl>AaRD0lDh{1TW%ViDz z=pfH?KJZc z$|ln`Z7A%}pFs-XTn65%cw-kp1|)xuO;LU!YDWA-MTT8wX@yc&14`A;{YIVS z%T`Xf=3li~T_+>bLdu>4JdG51MbJGkR|cJ(|A$+Flz%IH(?8PJg96{_wZgqWm}qdm{NGTU7A12n}Ayixs{wNG5^lkzl#9 zCk7Dnlvi$uU9uh<)+mROLtFe(h^YL?M69ivN%928ojszxIBq(RE(w;iO?g2pR&G*c}h_F@$%Q+1MKNHPbJjxXn zS>Z(-lkS(2ghsj(oTsf|$xroL+L~bEv6%8xf6|2>jlMfLxpRcnz3Gv@Pdp*{23!<2 z5MF3PoyCC_1K2MEI%p(qZL365(g3qafa3YQu1ANoE>gf;dQR`XV^>n=URc!D9+SB{ z9cdvR7$l)Mvs7)@$3xW!oQAZ;*F$^F4vNSTwTA9f>AIJM<#yt2!3n23%encL&RjGa zhBZU%P3liYdeU6roYIY{oah!rgavlNEKG*-ptg+h3aH-7_a3H3X)HZUSwxzPQHzd} z1Sn%CD-gLWsDqayOg<=@WWs2rObYWR~=@pgPS% zKaNBSc1fqbSpl2hKQO69Rz^e>S#~`RwJd3?`}_A{rD3yxjM#r0$_oKcHi9{8y!MM_ zgB4jOOO6^!!1P?Sexa0Z7 zJX2B|%H~niK4mm~PRjz6pi((*pfo_{9|zEX1`@?{YHJq?@CRZ|;-36O26;k3mf7`) z#5jKOIr#5JO-)K?Yh*UvpgSRp_{tT79BP2Sx zl=aNVcls&FsmhMUF2-5YCCk=WLbjNi(-F2b5qs_5uyv`**84VT70rSdV67q|r6BZuTk$zV<)cWf`w2LCmdyBok&UeWUUQOqg9MMhQ7;e`}#PjwXfn0A$zC1fqimv%Z)QwNq0Fu!!DDlo)u`occJW59>z$E#Yw!r!b;+PL=oahvoW z{T{hC$@HN8QRlo0uT5MJeH`EoQk-#hq)Lzjc{8?iEdhpUOI*Mlk;IR{x59>3DM%w& zCstw%WO?-$bS#Le-$eJ-EQaE*4mX*=ay|ikybu@hFi2-twF^PR_vfVAZ7xk;7)`U! zY!}TXGtDWK2uyls<>8Hq5A+$o?#vVP&I-h{aY*BCVF1!+@7F~Ym&g}72$DlQhp}}AQ$174F}7dhWRT$CSnzN#m4hSR2RSP zJwTrdS8ZTJIAcgET0&Q($=kSl&`dx|f47*P4wKM9&_X&V>}-psxrOH)zkDS5^Wosi zT$u)Yyg6ZEJlM4i<(j|{zhYNj_WKFAW5QB21QUx|0SfQaQFfGVAY>@4cuyLUJn@Lj zU0*O1DMndz2V&<9$F!aJHziN872^W6xmO);#bC^(@{Af>+qlD%nM-t`(hgt7oGS(X zg>nwbuGO#!;k5`JlY|u!_MVX<=)uB~qftOFQfT$Oq z;IGhkf?ek14^?eI$y*F_=#)mEdQN)x7*Swg;0tE})_qzWTBR6_yvHYCOJxPf&k~U~ zCXxrkbpHY`*A7$NjLVKmJyURRB)b|e;s&*EJ*aM2Jr~^oH0p-oT~MVmK))vIWX$Uq z0htBYqmLWM7<7tx1TCR97wGzW+OVe(6cjcwWLR8_WGXVl0fY&&ZRd3t#EX>T=T)MW z%r@UQ1R>S=VmD>0afCvv6do?y_2Iy;74--Ewe_bj9R{OD_eSW5QdOp`L%pQkU(HH; zr`35wJ`Y!$cAxVHOShhNTUAV=%zwi&3Y@1dW%csZiLHe}^xiEAqJ} z-Xs)p=<1da@Z_nLLql~pkpRWx@qCj$tNQFKWD_s+;=Vj;_o`KL5+)uTi;t?NmKOZm zXX;|`Ee}0D2r};h{-T>;-cXgxVO`LNsXrZ4sqp6e>;Sl!tvJC1z&j!fKrx?v>RjYR z1<}@t3T~S)rusB;RPQq;0{XX4)g~yC*Nss|{m#PcVm|L;DP}wQ+F`aM$ar|CQbi{H zbpg%dYHxO4y5aY1TeK(R47@dIu;70b1i`(@HYVams!FDZ9?r=g+cMA?+-Uct(9E@xeh+>XhjJ1##jL@ynRA~e3}X3u`Bt-k zE1mis%wp|Yhn2cxv|%os<5vQnl!-DbYv&j}cAp@?S6TQ%0L|zC5sr^ay648ugHkz9 zo9li>WQi2#$UC-Pg1<7fRj|9>ulUhnR!eh^+a-V8_tfK;&b}mf>=pn5700#ohD|5qS7$fh}vM_LlcFoE@jNj1KpN!}S#tzxX zys6H7x{czkS-O=Gb7HiV3CtZgV*FO@#xm=FaN!xsSVpr1<#J(H33bN&ya&00c*LLc z{+}jj8hT$*>aSqRZ3@z_P}h?+SXQ}4K<09?yYmJEIjc> zceks_ZXZGPG!XY&cuNTzFs4+JmL&_S+MGA3Dr&zB z;{qts=B#h7i?7NZUFlJ&o9{ukrk(-|V}w!zPDu^)L?I_7@_H5v8trs`<{Ql|IUsl2 zDldN9FVF)ojx?M1r|!nX+<&9z&_MiSKMQ6n*2IvOOxVQwncvrKqgF7G^pOq4MDLGB zbx9UVY2`P>2PQ%7PsV|H5C!!%e!W+JG`y7zw~3v~!N+TCaf}ujeMs7z{l`awL9K~Z zh9D55q&b^el6@TBf>>tdjIHYSKGel+%dv*fknO}|hc*)rQ!p?e#*Hby&mJ-4$6v1X zPmiE1-cJ+~o#dq*=sX%IYFwa7trXroF>dJictqaxK+T;(YcEu(7^9W>Hai+pZvNI1 z$>9<|0MmxCU1RsA5lO_Be}TH*nLW1eTD`+au`cAlNgcW568FhygdSLIx}3HHUMHWY z_=x*RY8DUJ*TE9X@1`)@&D#rD^dSSDOEfyRNvs3ulZ7NaDUBiqzY(RMc6xiu4y%gA zkYt9NBh2Jworup6edV7L;s`fBpt8^NDKi_8DCCdd2OjPLkPjFrtUcUi7Y`{Wp8k~&<;$M2J`}j^w98tcCaFe^%~9KZORY`Eiht|x zcGTkp5jo*nmrDeXLMR67nJsAN2la)d_q3a+Auyy9-VBz-ygXYbtFB|CWxYy^9gjhx zUk|)geogsGdXod+M3^pvNi|PP&Dcl_9WmMujJ^j}X8D{1LYi*#k-t4*ix#Q0#|Z{a z;+|cHK|~8vd=s2Zi=13RyTO>mlcFi;lSGL*2I1fp+N?YE1bCK0muDA~0JT3e#AE>7 zZixX1G+o*!*)j1Uw)Il>WOH=SgCO5PB{xz_d4$OYcDg@GdnW9!g1_Mx4aakG|2t?l0wqD@tWrti! z)$Vw8MpJ$@mkfusDM~XMKY64D+8%t~%_Vj8XqUJZT3wL`YQ3WgrrirY!F!P-aRu$* z#1xq2SB3N&FgORr;rm5rS0u!1ZRC2Gyg(ESqmu~@R4q7A5_-Ao0n?iN z>;J|)jIi`LMXHGWk{`n@3FzD{E$96RiF(saw0w#SBFd9@dtpjJ%p^2iwIDk9be>mc zF=1#p-0KX~MC^F$4!M`%RM~+H($B65Suu_L%m&;l*Z!QPv94E9I`$cWHt<_2uXX`)R(IXJ>mnB}B z&{*g^1S7?7y<^ZFcx69eP8_Ch|PCO{8l?+|G}Ih>HM=L%~9tAb_pcf%493e=x^ z*hiLUA|G+zs`~aWr&1oxY}bxlKr+Okt9hOu&3wM*_l2x_oVF?Ij2`Qm?C75nPj4;( zRaF)1dgv9~*WF`JFO`nTrCndLpjZwl%)ofySg-o1UpA>n!)R~OQ;e;{4!$b zm{&DoE}ag*IHA-p{NOO26=9br<%*3WS%%tr2v+%R>caDWYz}Q>+;lnM zwCPNGaog57&7zrh&ff>f>>W|utzY2@NuREQGRTL{xNDyK)6ljjeiQsDgg65 zqa0a(v1uv3Uri-d=cqauG1zoRp^UOXCfioN<|}CJ_ENP&6x%sd`%iC>RU2IMyI2|8 zV4yll0ydgR7fMUL_q_PI0hfZyh2d;wTO^gSC_R#toM{WXA$yllk91?!;-Uf zJ7UgC18RsU96&M26}6LOFiU_8n7zc?Sk;I+CP=e3+dAs4t7gf}o<>B+CtgS)-|m+o zl0LBDy{8XJ787%&q=#7~^{j!Vr9Wnphc63)7g+>W(} zkse0X8uVM1sWPL8SsoNt%Tb@L)@E(uG(8~*<+%>5G#W%^kPz~M4>L=DqU`2>iTgN) z5HrSubO;vc6jf}S;dz9SIiSv+Lri|~HcjLh#3LhdAr`u^XVDprsp2{sDS}M`ij$|< zfd7{@#O>JT8FDwCLEHGx#-zTi#>8?I3m~8HTdG|L$!j$#EDOO}w*TBMKHGlFyL?H$ zvugzVjsXU#PFm~ScX#0Ir_<^V916N)fom~~0N!r=p|BFS)yGNb!M~cx)rH7+4oa+n zHF~J-UQKpX4HHVpbhL2hZlq*&`zwL<#g>e0^JN6NTIG4K4X3$KpH->2~Juq~I5lPXdrMG-B7S)=@EDy!H*thLZUFY96ipoY6t)u(-&m$tFnZ$kMG1#Dv`9n!srIf}Z*3YAMa# z#SbRkqhuuc5spC>9VjA+R0p0`2ppB;lw|%Y3 z-6s5V$N5+p#(}#6c7CA2hH%d5k=!tbehKIZCNI?H>!)VvI>rV?KdqZuyGLmN3)L{@Yw*(mMU!|USt^DjLmc~yx9e$zmtZ6Z*LMg zEy9V!-mRvAO7Js_^3+rJw|6g-)7sWL`Q#dgnsJJGqjTk7)PLSXNmag@=kqDmd1;|~wKD-`IZm?m zdvVfi&-YEn6ec!B!#CBnXx;=}32fg8lg$cjZjc1^z_`6dxkl~L)BW%Gg1MYG;#CNk zBH4n3vER!6uw6*O^%>)3+r~-54ob(K^g>bVi*jn&w_ydpd5mv3U&%DglvTLRC-gFU zp=oNcDH?C?y^S3LTyW>dWt9lc!n%uZltmEpD~ja@%Lc#zx~yg~h@(^6ADX1Jw|=k! zL?XSt)tQ%;23A~P_iO2s-BNe^P>kz0`&oYvLl&p4BICJjs!%oO%11vS$mNgE2$pkw zy0{0skY|~WPJD{oBZ#4aEl#seTeX&B&uOfUO_DbiVTh^+ej^0m8pD$JTo>5z3K)MR ziY{Gq`|d*{&W@Z_;E_z|7VmcefDlL|7}?kvdKue_$lSlUtn_xF8RpmVjjg508<>>C z$R-Y5pi-JJmT`{IJ9`<&BT2KB9)NCoN5xrbC5BG0Nu1RK_#TM#8T)lO^{4?E%}kYM zb(w^=L;^orL-eQRUQODdxs?~5ts18#QmE?BSJ+@&HYu->H^oJ7ANNfO5Wc1I;ge?m zwT?uiJEzEacY|<@;yF$gu&wMhCAaCtros&ToD3bRxGMz&#jh_}Cvqjl691gqV9OHp zi!czhPucJh0PJfenle51nCO!M6IX8wlm!E+bH_2$#kRsM0K(wT1L)#3nENRx5HuJ} zFare4jGL*qUG~FCkd{_gh3sJ>v`tHTjkzE|_1!uA585T^cCtsrtToO;*>wd7_BdU0 zq(kbz9Q2Y}#aY9*Y~FBDBl>Ae`%$ki{NRG#-t96*8U`rZ)GLK4dqUKOsc{iO8Inq{ zNelBnk?vNL62}Ho50yy(vUz`eZMk1+k5o+%FzpAlf0C3p>j^yx7R?c z1S({S^%#L%piNXTPA%FL4g3GOCfx?N|DWmkIdjDtOFq(#{?KY&&T-X^(yqMRG&cS= zxf^t)oA+mL2eXVY3g%-|D~^r_xO3Q~u5Du$EQS%)S@eg}xB#8V=i|r9b|V)Iq<=lh zs99)lfn2Y2MteDlBm|kYoFb&&=O|rl97H?85EBc zB1KFF|94O!w7_Ny{%KVRc&K)L+_)u8y@;_xCAjiOXeWIs+hmMW#%(&W$%0mFt&*L0 zraKqaDt^6A;wo9uo00V)`5^_%0}82%1GVM|c+HM}r%}4RrumtDaWwOdhv$eZCiuvG z%4!WSYuRM2yEVqCCwgG01m=5T>YQ=l+T;;gB!$B=BAp$WVUH+ov#^!D;|rIXL@ut+ zJziFqmT^sLM==X+;%LcAGf;a`o?x*=T=$`IrNuywL2vO_ThURNm~_1sCOd6={3ZoE zN(Zt9Imkx?sNNs3(S61GaXP*@%SQsGD?qYb>>|M3B^mIVBnd+*xH;XA8G&4zm6E0{ zj%-My*ULF-Iv#g!w^t+!B4R>hE%-*YV!p7^Q9RY)_RhkhXVRf3u~+|3<|+}n#M70| z<3F3%kU%rU>F_KDbe(#goPi;&*~u_S!^4K)^6c`nvm<}Wl^$B)A zls?RA=03(>e`W%{WbkbpIrynsqqWW}~G*ye`zQn*Ke37fKEq46sBO*#=_i_Q>wZ%Mx>G$;l)K}sfE(cno_aK$b3 z+Ur>9Z0vC^w*A>Ctko=pwNjYUz4m>zfh75poH#q5I+pX!N_{EdECTEII ziZJv9h|Fg!U4<6c=8RJR2#<MccUIcN98(=9rc}k48-^+lVx&*}n|6$ee*j+bgn}qG_(#e~H_et`DPOZiWOI-n9(3;W0nGkecEz>4U^!oR=R=Kj$zNct2n!hY zXIcZ$wqycy*v9}aVpZ31{i;Eh)nuy;bs_v&{Oas;CCSGVhAY)F2zYdQ(NC}aY+X*? zgoWHjRC_-Q-s;pZnYN-2H&S)WRwB?|x)1C)32w=6^#YZ@xO=1t7U?Cof)Fsa_(;vW zf^}nnTDS4Irf$!0LmTkzK&u^Ag^`cHJ=c_g$I2|61ox88_sy$#D zo=`V-x@a|gYBL;^o#J-zu=yN<*G)<~)5joRgH|r~7}*a1yVTNx2>Va?jslJhjY@Wl)cHeoXby-d38WPC%?)M^ zhRQ-Py=K>hn_#vIrmGOIcM@spNmc=n4_vmudefsW)<*J7E*}}HyD7YLzI{J;wdK0U z!X|1p?+S>0+Qlw+c#DdmfzA^puA*R?Fld!AF**NvXcxzL&Z$naQN-?Bu<;A7Sbsk% z+GVZoD!A6W}V^I7q$jG5Y*%~4^s-RU#KaOZnrci5H14|^QLk9Lnx=A z7AwcZ!&p*|Eo?gWy`xVmD%FC+&n{w`obuVqkr|ra+UF1$En3BwGzAs_cU#lk{)Sk6 zL2Qu=JpCz_2FWSq>D~HYm486EpwL?s`jLcw%@>(JjThJ@CWSXSqI$BdgDhQzpM7|L zTJmBz1zg2U%C5DZHB};q=)7)R7Ky1%cEPISsNv9=E6UO#M83xTrAvesQ@%~yQ`YOA zeWTAOEr$50^@-@HnsZJ zvycsD>damX1bqQY{k)iA#?+}RuB0Vb)j5Lwwg;RR73q~3W& zq-&vLw-W(4gdA9M=gZx~V`zcr^&$^fD2R3_WU z7cSC$soe%gNjwzGm# zXZeOLr*#KFb%2Zz*Z}Vd${+k~j1-(bA6n8PHEVfug!C1UU{8!Bbo<;uFzto+0p*W2g}vf}MDvqU(m~H6s1R zGLw}WuVM+q(*u@!wG^m|gx#Rz8l|KH)zMqF<(kB^NxMajI|WB(j44LK`<=3tu8G~}P7*es@q4)7T1_gK!xFXw8)i>L5+(m=ow4L`O0N(E0>TI;&3(D&A9449~ni z8Ch^Ze0^5LeAA`uarUtyKQJ@;>rK?n9DEQKvVb7sjeYK9h@Fu5(@rKJ*>pGVP`JrM zHO)6J`b^jI$z?D6>NVb@lMEjULuIJgV19^i6qU z;X9UX{N--U``7^W0`0GNckF~Cc7x~sbTh=Cnm??2n-1zstR@nv@S=n6*f)ldGQ@G< zdl#`@DcrtDj09e*#;OQ^?W@M51e!th&pAlF!S0!FAzusWc2pYqsIGuy#RC7%=u#S| za!Mk_Z6MZve}5yg%de&-9V;@~Wy=d-B8Z2~+;g&@+X`W&=jFz%ZH+1jFWI_s=O$|z z%v9UNg*M;F9wv23RQjcQ2*$LppMIStywUe)tS%>gMn*uwlL1J-+>Z(fIvsh7FQxY^ zf8C3r6)P)y)dXkmvGhOVm>PJAT2H`;;Aa;_CiE8@QHmA(L*s!lPi2G(j5wPWOM^rv6rn-u!E3Jx`>-7VXWT= z{W`yFGI#FC&gNFck<*G!Rqs(a)mIZ8!Lc{CC>*B%apbNj6NV_Zj)R$`a;8%dzF#Ai zj6z8*a1s{@DyK8xPe0uIxtIb1<>&#GNk+hB#l==u=P)~NE~0`8P^W1)TcVZQ5gTNC zWgbX>BQUY!;Gz2?a4WRF5#P5YU1G89mThAb2@B!BSvPrCV=jhxcMCNoiU7sDkuW)g zbD^K$4lO{fLr zBbERmx&-WE&9`+N(Pjm+I}2jL?KmCjythPp*vgKDv(23LVpoNz9QF;0YuN8>o}>H$ znouDfr6z^1XZ~X17#Czag{)!ar6A!1J;RluZ@^FC!X!Dlsj6Vt<4P;|YZe4S8sRo* zYG^+)vW+B^1Dx`q!Lf&h{i={b1Yl$;OycMvCesGlz9wq-Uq-3Xk<}hhC?+k>$p{L% zPTA7UnI~}7N8QW4%53N^7;wJK)B&ez@T}Lso8}mY2MOjimpQAH9ynhxqR5<<>sJJ* zchAxBkUdwL9Y^r%G~$fY0A6w)+pwgoYR)cbR2dAjtE%%_Yiby3DM-8rt}^e!J8fvnT0~!k2Q=pY8JPe*M0{rdij}lYg7)69hPMhIt9B2sV#0QCh-2YIQ!1YTM*y>3!sa&2RmiHB9pW8w@5N$xwW zN2IAjcSB^=-isE%onmb;F9je>l=XT{i0ys!ocDHVicmV%PK-eqnTc2$9@{1tT%zYs zKwK$e+KB`KFxF-Ak~Vwf>+N(E!;77t*va@wGtcAnL9iAwge5GlALbL1NbIiX-xORi zX&P41Gvwg&MqQ*R zg%a4=L#}N+oER?AUS_`s8|^wP^7spK7o{?6oAV~YKwtpfc(XH9fn=-?te33zUv(96 zLQL+iV?$Ix(#DCENuIHo+Wa{$Gd%mn<@IBiN-DP7?l~~Q&MMRBLN#uX+`g@_?D}y> z_AVtto^beCVf>oMv_W<{1G;6OIc7O_4(nEy{^MG(K&Sm8o)C;5s2nDCA!>3vRp2|*JF&lW)y$g8gJy*W5LlhLQwS>4$5gbK^RJqM`jXTsUYuaH_AWm^!pN=1p1Wi zT0|n;1cNv^H+o|JtI}?CYua|(5Uo(vu+T0ket8|}3 z#$Bda)!jNTyzSh<6+E_g!Km!!!ZYAK8c$e9P3X?8A#gUKTD53*zo`*$;*Tjn9pP^g zowrW&(@ND(&GKpJRmk4x*oguIvj7Qe!*{A|2`7C6HacxGD|N86zwqxj!1>Mf>koqV z$(CviW#o_iF@nD*{$F>7#@gGZjfAa(qQDvqRMmIS7-@d?ocs!9AFk4`s*JEtSH)Gk zpMM_(pllIW9TLiTj?xNa^;mw3deWCbGc&Yf&oS~j!Ie}=q}X0l0Ps3|Mg^%DT#V1z z(TK-Ef{J_zU$T4pc?>Vy(@?RsOwjJj(m)yWD2~ZkZGpniQiI_h@ZmI=YGcrXMGf8b z8P4Rzlb4q$X@y^n+OxTctrN?K;HBjH7HuOyC>_1epGn00D&RO$PA|JLw#$?Jp;Dw! z0daqmx?-IRIc$&=-ef6D5{^@isUQ#}8)i6C=O8>DKowG{3iXVqp@ldRG(W!8O_2RQ z{zvQ|{b!2~qjYEd0G+SXkcgyv7$V#SYd}&g3h?)yn0kFxj`!hR5n zFas-3`xxG2&H(|YTMga7iuu{QiXd8c47xeV7)ABmKsTnGa(%M?lVxi6Ti-fHGb}_D zM+hCL^RaWzf;aiZ^EX?n07-t+&zqCEx#X4X_%A8}`16OLCd6ZIw=2!?B!o@T#rqbD z_%?uuOU*Is)ulT~Vp=fprM^SESDC@3`xQwKlm=nl@~6gx3_9su)=jEtG(N5!LFhZ* z(H1%AjBMTBIkkW6&K0{0ft|(axKjq&^dH_b#Dx@eqttEFYj{Fk@4O%*wR&Zp7}h*1 z)}gQf7w!<%&5Xu0A&R~0+7?6GjQ>pU)LFhW=RJCi`%nBm8FcMa@Z|OA0T+zf>ZkGf z4k9eti!SCZ{dkPJ-%vpWXozzk%c=D;eN0f_f0*cqWObpVgb}|F(B2I%d8+W%IqM%LD3IJ|o*fhGbiLuWB6arBf#)TLwpHp%&8FKa11gv+{`->=UbF3d_GqNhK;-N1 z(rjS_`1@3^2&DA0=RY|g~y{Yy&?ji^#MWP>QU$&xzFMqlZ^ZL_MR&4vv0MU z-Ajup(X!t;{p>5DJw%G*R#NsR8U8BJm*O(hV{G`*d@_!JSU-o?`RS(3!w`d69CHd-g60{D&j>j=~o2LXTO+Mw-lW2w>pGZd2;vd_*hiO(w%9s_tea z8{K8q-JZD2{tGZOPtfPBchc<2eYIf*YDS3QrmU{0VvdN#HmN4=krN|?T^yZ_(Uqge zMsjN9-l&%SJXCTcH~k|bs$cDle?F<62Ik@&3bWj@0e3-KskDd7yf}09DXUBIYpX3R z;lv;KBHo>gog23ZHAT*<=h5k}j+5M?XwfmOUxT!sM2I%k7WqrYcW}|r{`&y0Y*Xgz zt4|#s1(1{FQ5TrN7;LSv;Q!xB>KjH^|4NN%k3;|kfL5`d>9!U*#lqPG@HB9O$&a&! zqN6D8uCU=PAQOnx6=8FRemw#0;eP@QudaA5Fmg?8?ya>L#tLU@djTr>YVmVrStgsI zyiEi_-^ux2;bszGpIySA5bif6oGDtjw)wNQ^wbx-$V;QVZj-j(%Dn_DrI&M&m6*r1 z&|7mh5Ecv-weu~xqnt8Vrl!a{YAB-YhZ7+(A;U~So5Wu0TqW06fpeC`&<{ zC1Sy^&CwS^yr4|1v>Q3#Q$pMZItx4e;5Rq;0AOBI!3^M#>AVIts(!BNPFYrKNtCWI zBPb}DEzi^kY#kv%Rt()@*>1Q zN(HMXU?rG<_Z6PK{V4Vom1;9qoh10Y=Gd%2>1?p;ojOB!(9vQ)SI)q`Eg1arfI~{I zZ6cu~s+Ss!vFQL01QxJaM9~w44+OT;;=oz(kycL%@#};4_x3XZOL6C%V=)y@L#lcHi2}Wm z%6;$BD1bqin4Z0NU$^vJ8QD1*3)*OzXE6i|b55*_;59p|X-Lz6bnT-x{Ju*e5keKs-9ku4zwGi zq(hUq3*G)F0P>wtaR0w#sL-HnGdU{Go8y9yDAwgxqIYkp7Z@O(uaYh7kP?KVV~XVL zesnx$#A}*c3eh7xz0*H)p)g)5*gMY}Uw|n^qVks!zLQ3oqz~Auk{Nse9IxK zJDwtcJDcX@tSb!iHgOIghDmXIGLl4^EcEjrs(JD6Il27_2k0a%hk8!;6;M%+3N0Ss zdsFGNFc?FTyq9e9piMK;>1^BT7Bh;WaGWZwZy%}vQ3E?!X2>M7YnU}N&mXz=H;wXu z!P~H?W-5KO#}?Ko_5NeTU)}x+J${uETjQWbp-5f9zBxoBzw-32=?>+LjkU|8!vOAW z;V?hwinruI-eKs4b^IWCEQ!sCX^?#!FE!mhY@L(~G~$8}cZnw;u?Uvm$b$!^ueXWJxNgOb5@yHfzEEow*ctP`SWUfJSe4g-H7H^ zC58YTg2#`?U6^&<57E4!4r?AKsQfJ2iRc^5kRZI(w1n(xQeD(mwD3S)%J{#?p)z2j_+lIu>pE zu%loI13)D|Joy>HSDhtwlJE{BKa(v1?_lK~w#z?LIjR{CXqNH#7pP&?%q$TioYN&} z8f)?LQ|-rRp;9LLXt%3$alQMs`WW1tnTnOyH*k@wG1y}choEc@(l4;4w)<_cTJMHz z{1PL(e*L@K@zF{+E22sghe2A+?FMKDV^hfrs z=e&Z)z8zZz7_(wWl16k^fd}0SklP>siSVyie@z`Z8cz%<3-oGfQS98kj|G(2Wo__s z44A{o*{ULk@sfCu37NVLos&vR(`k=F-}l|RzWrW8T2*J`aOkIf67Wyg#TKYmN@c=2 zvfA5z9RkOFy3_!3Vd8Bixlj`~v!d;Kw)$w;Ef?}VGJ1K3R>V>F)5z(D+GKZ}B#Ijz zpQr)pxioQ;KMk63WHZ`0&&3aKU2RgfDOw1J~TRr)nQ<%aHV3cPoHCG0em4%+J&0nvlu}YW+@~Gl^t2EEJxJaR{j8VsT#G zo2>0`7*3ytx=L-Ba*N^ga1lKl=e5v?aNRO*i3*pVa~5pBEMmJ~x5b0N~@&=WB zUGHP_2SdHtxuPg^%6onAIlaRv*;(S?Tg_Qk!7`wO!UW+(Fv#so#*9WhAoWge@R9ma z^NU@-ypT#XC@t(8B7Bnw-@G<;!j{$oYbx2Pgd-Qc&HK6xMX|=IZsYLSS@#sQ9|tcl z=yvLF2tUx=wbh+Pl01Us%*_}11Qblf>E<^){&$`0kfFmen;EIV@yf_uL|OD=r%75P zUe#}lO(Z43)}33G-t$0PcJ1Q|Vc5{p1ufss$u6qZN|5R)sey~oP!R$0T^s0P>sNl| z8Y%XV4vFjhXANAzh|^iNGlLAjGROb%)ZC8LKE*8agHRPKw7$6M{|OSs4=fJD=ViA| zj8AtCE}fuf4-C;y9sxFK=|OMEa9G$Z?&1+|qIaVV6di**9ZAg9>t4q zo3)S{5T8uoT}=qL3b-12^IZO0I-EV;b-61M-yEzj{Pma!5E4O0+=4?8r=ulFKeTsy z=VjrtFuH==bsX;AG;DYFX~L7$SYFUVWdhSPhjC+(SCxgTHs%5voz~8v?#ibpP*d}< zvhN{=xMN2L6ug67G&_WFNKIvu`0%q4p(Tk|JIoL-{~2RF7f zi9jrwE<;@iV@~1$;i4$;*{f`l2iGMP$g60F;c5u!D3TUk()Yp}HZz7+SGdVriHrPy zQfTuVJ)L6niGX5R@6gMH;e8xZItmk`au$vcCytZKNe;vdcZARQ6ZTG#H0Ji9X zgsBbQYsva8-+(pE)B;#mR^~F;db3;Q5Ow{;n^%IDI}a6*#zn)!aSrRspTv7vXW2|};T z)-~nB&8mLaB>*>WFyp4`X~zljq^y0gXV5i=dQw{H2ssDZg6Rl!)N>mvRdgt|3Yjz- z<~o>?aselj2W~wUFxT0uu`SBJL^AhNB(i_8d!^Wml=5RfviYm6i8ATdIdM;s2b8s zDeU{wqMX!hC`|r31+(WYsUdB92}pG~(UEMjI<=Eb5nEsXR1m7Z3r7T0+$RrmdLxgj zPo(t1PMc~I{Kx?SGmX1ZK$Z?gwJ3+M*kr9Ky$HDK=r@m@@4@2d=f;JQ=#!@q} zk&rT#2(|3#!YydFac`fB--Zw$fPRs-x%2~0ya|LeQRP>0FW#Bs`Kp^d&jwsl(Ub#y z0APkPrlceqe>PXuk~Aad0O3oUwat#?$#XR&*>2n9KM&}6pZmsqikVb2NIWw!iw$us z-E1-Bw#ZF0^<~>iw)Wjpx2kg~+oPettl++3pfy24gn^Rgj$v?2-AV>TlP7l_{&boB zzSW?%)WJ|Er@rcpavd`qW3YTCDTqt^u2Ky^HzQ778>!7`Et?Zv{~t2O2_H{mA7J3} z$3hIe8S(7os1X#~vfWv>p$=lQ02e{*8B~^(HTORIG#m6*QM`qD&Cu69Bkz4Yi7Pxt^Mv@GY41Q=+R!ATURc-(pw|lx1nh+D|v(?E=NHiiJOvo(5bfA!vaW0)<|3#6sd#a z3y7CdE~mafNw;)i8@Ix~G7^-if2nuqQsQ%Agi*-IG#S;Rp_JeOUoiq_0#-+Mbn zj#^h(x^9~ijT=tez#D^W{X+Xt?hAOKl+Ox;13S={?z8yimLICOVh6?8F<02Uh-e}q zS-$Ne1{7Yp)nLW*(&tu`*IuNx`{%PD0EynIAuNTO9uPw!eY|aLd8dR%Hr9h%DU(3F z^%)%Y@jua3zXlqq6PUBpFiHfy4|)khb_E`Mxnuqg-!a8AsLIuX`8(hGQL zCY>&+CGHEm8naP6R7F7DH&6d(1nk-%d;jX|SucMLjTetq zOWK}jMJ3EZ=8Z6a6H}*?3sOkCbhzX)t1I>HgV0lc$;g8oKI(B~or*$0*4$Z>lDm)e ztszfhx`8ay1@{_Z4q)yn=pfR8g7CJ2Ra2x+6U+C!ISOqgFo+r|mANO;-nwTO+3bsA z!u$^%wmY*}oXIrRRG#?jXnIh`Zn^N5t(m_OA+VADYs_I7Q|KX)F=TfpL0}L_xdcTQ zN52ytlUNi~&h!$R_vW}@4ls@4utuz0XVsj2etqU%i`c2kLqZ0pUwo{)!vJSCdjLf&;Dp<`& zyK`!sh;u(%U-4`DoLrw429sig#1uK!nW;PY-tb_7rfm}Ed81( z(KMxx@Q|?W3O#2On%J4)L~-J=3;m`k$`H+vMi(e6>zRuD@7DXmp_T##=!b!0=){7f zxwf;SJ|4&|d&dD~j6(xTEigO7Zl&`?mAQY4m#c%VezBafm1c9fQ%s5CH}`x8{tk*k zD_)|#S1A6>J2mno$&Bg_6r}bI&!t}rb`YIvzBE0CTxX9mO@OH!6ZQ74CX0 zbRJ%ulDPAA>B1*zIWTyMBSgf=(a2Le3KjCTmn3)2i}z^~kGdt-qOX{LICXpVPXYw8 zHv|^;vZi5p&|obz{~^_*0(6 zXsmek?|&P&Q^MzMWBhp+Kc^_*gd*r^&zsXc|Dy_!SQsq2CDqR0YjTYt7e#sZ3!<#SWvzhiLq5+SZD^TBq^(o=r)# ziS~>jS!pt>j2`N0DgFv(!#!;4o*+Ib^b7{(<1ocFe=zT&}T{d$hd)5U$ zmA@gzdo8*rW1?r@%>CPW?r%hMofcKnI!Osk@G8*0;Xu|}|FiFez2ia95RF7qOJoqc znHzO;gyXLVS4s;T}b@UtzbOKC*lz;MO!c;g12d00Te3(ZYZn-0t~BQ5PrjRy5_ z5o*0_1`JufCqS2Kt@iHSDj-uQ{rmgih_?V7ue9BQ8rBK|d;pJ#pj={#8()9DmF+Js ziRt22V_RU22M$nRy8FRM1Z5uB)P3P?A`WH+>ieaTyDe>QRUwY8s6L&9^R%x~177-v z3ZqUFutTAdc51a!j32lKCb5A zB6(i~gRbicx<4JS4!HY$;JIQ)%Z3rkE zOqAx>B*8_6k#MqZIf4pmVp0f=59y_>_N1Ibj=`O0_{oh9J%ihQ{StehCA1} z2eX;uO+Qxx(M_aHg05$i8J6!EZ{epDG0X83E1MQmN1c(W!0wAVP^$|*o|_4JovRpu zo!NtPuysrf97Sb}HXag5E87S;d5AuXo@a zRwbX9$B_5=Y&K;ZVoF7zpVwpMjes@J?wy@>oMtT@R6Qf)ex)u(RE`HT^Fi4>vCwEh zeFb;y!$j?MbnU?pT_BsBtB>>FBzX@7l-_8fom4R}{Sbz|y)EL)Pc_#1VUHsF<1_O> z7ZBDuSz8dD65Ep{7NY(X>{b;F{p+9P@n~U#>3o+a)N1h@9pC)p^x6J#{b=;`4fLmh zRWKpga#}d=Qr5l2%$$Q_Vq@t|a_jd(ZJ=s*;*Nn>gt~t#3VlDKP9sJ?qS}<&9VF03 z(SHqxGU@TSjYra(-Za5DLkOtVC}GThR12@`#BQ=9Jo%l06V0^Yz1S0bdi3@t2e0lj z7c!RE39T8Xvg+$Qdsg1m|A%TLfaAob>)LZ`Vn>c9_{o3Z*_rK_1}oO3=OVo>&|5Np z7;5**KK*ECn?LslV<)nHk2!cVaS?Nd))ymXbz8cOsEZ|01!BIf>$!uuM>qqL;!qsI zcLTQp3Ey<6mu`Bb!wzndR)il(I2G%^!Se!Q!ydy#rpm{Q(vsv z&g3^H6lLZmmqg^GE?~jNnd+JasaxwnJ`GL)5rrtYVLFO>ybf;gRU)|0E8#O-$qsl9 zfw7m?dw&o1l>oQuieDYbD27Tb%t`>lK+k)_C|pvEyBUB+`wJtNA@6U6v)8Qlw$N3o zVuviH%%HOrNop*1L;f#?N_oV6hFv8Y-;_Vd;zaYuQWiP2vi=Yz)mIUdOWDy-R}@r6 zZLm>99LhApB|i@&o>&Ga299`O0=RmOKkq43&7sH|7Ht9XKIS-*$g#M(PKw-9-j1(P$-{;s=Va?OR zFR+xU%YVF~o@AzZG6)t`YoyU+=S94@O~gjlo0h>$`cMxq*5$xT-S*;39-Fms-`1o? z3%1qR4&?v!N3*SXbx`Bii@J7eyi_7PaEj;~hs-6BcNE$UXWv=6OV(2eb9+jAdU#Me zD&isjwES}g+Zy$*+P`71E6R!&4>cZOP&B@#*SDYB5@>`Ox)U-zI4WeRzj5Kzi^j@{ zsSjYX229#tklMuif|fT~fbOZ>2{~4W89c%|AbRrMl@8MT7n}AR$tee`@vP@cc6z5i z-PWES<3ex<)ejvXmd3*g81_1QbjKXz?Jqt0K~O5}dU6uK%Pm|}`5ACG?w(hMVLPKK znT!VRPR+Ri`EhQm8bU^bQB??418(lmaqx0ph#U zr%EM-NQCY+2!0*h59)3=5%uBE=TKHug%W&+mEjNy_eGxdF>D_3a0p>G@WSD_y&*NB z;SPxg1F}l`NvI`a!nR*-F^ITrUopy@M>tmiCaPje;yLqf6O9#SSv#Z9+Si z@D|cjhjK=^c-{hp6{56d6Bf;4;I zsjFBqiu584is{J~cBhm;#kKAHF-X~t3gyXsr(puP z4NWr5-AiM|awoK6>1>#wy}cqX2C_4h0#q4&@;W4Qcp^KqVE!%pQiS?b z(ILLv7fjjd?U2ec4ep2-%|P&Mt~rs+Y)?x=jX{$8ZZZb5`DeDe4bc}N0MRPZeh^7# zR@P%OFxRg#llFoWNuu3z$0gLRTZYP*PAr$LbY|Go32z*EQ*ZamnrR^}+sdS_P%2`u z5$6eblesq*8f5B%O+;(zFOB!$F} z#GLbQbIpj|s00z5){w517{Jvhwdn3ijaVPCTVII~=efoKDEM{wrj_qmvO&j$X_{>_FVyvQEdMD(&7ea@Q$NislgjY$my;@>drmFR7q5DXPQxs zr@09l6qZl2lcF)xV>~!vb4)dWsM)ZqawiQ{s6R)dZ1|Ur-S$JGYj(W!V~t0(AuY+)uxqs&4wcLAVETc&-=Xu23(NXAf!; z6z*|NA0fwiOEmG*O}`=MiQ;A-ktz1AX8q=)3wIhOo^&mzJs~hVbmzc$vPoZhXa%no zkoxHrlPPc&Qx{Hvte>vWhK}Zso4t)82I2^dXJTrKMRnQ8{TblspagB3lN64QGQ-{8uO4r=x{<4z?b;!)&nETzT074hg-FqIWd>r)h%9S1 z?r>0%TYF!?*}FiBEbv0(Qq=N9^#K^piL9%xo$iET#WOM3{-a;8u`M3F%PPA!WzX$88 zUG5odY5;y{M$Cx*8<#w9mpF=qA9DVD$F(eFfBg_1?6?d$1( zu3WqQ_lrUJQmsl}7dUA+1`~F~2f1TARIDb>g|M4bVuPitthR;W`z3ngIP|sR`vxp5TEU7tHFb%@0T2gQi}35 z#CZOq{|rkX?tXHn!~l_B8WpR?4jg*JDttgE5k202YL7_nk^-$f{m7qzy+d$_)6fwM z3Ti~rne>>d1EA7JX$qZEBg$Kczfu76SCzgg)(2(SW#{y5-uO~#1W5#s6(%^{nz>R7 z#ZLGc?9f#48-O~XWu-1g;8HDqqW9h(5pM6p1=I4h7XdYJ@?25-;>B1YCo=&f`W0_k zS1f{FL@lg?z1C-;u~5I#Nn`ErntI*F?P&E#2ENzHtK?S6J1zwOuF9?u;qqo*Rt^1- zU*mec$V)Sj`vh}r+~e8og3Jr*#uCp!a)#+if9BmCxY%?$Ou`loQU|(wd8q_!$9jnJ z;RL1aJ8}U!-97koJ?n0(W#WAiX-46!7=kHcz)QulV)5Y_V6qxLKYQUlGjCCW=V-LAM4M?8>NEd)H^42oQ$Jnl|qO}a}COQUeL zBxK5x0BKw1mPyhAC06)*O^J|yI7cwv3I(hG1}Qokur>wzKWS~@6%Bs+7I!q@Gu)-K zkaw{0n}MY0sUfGClvhyt>aSqtqxTK!vf@nTXnhGUr1IlWx)F)J!gDf zb!RN>-~CRh>5@9{Er^>eA45y^q%DG2Csr4L#435sq#`8x)ETXxAmVDCGM9DUa4!i%Vj`IM|d zuT*M{2==S4vvi#_roB3So_kQD(QDC-NwOw80(3Pg#)l(@tHW-mR%lZk* z4g>F~^L7ZMpI$wI{vA}xYp%VkYwuG|p{r!>XibCiZVy>KZ-o!K$}U1on0MQQY( z-|)p%2#=;iI$^b3;8f)g^*JQQJ9l83e<3Y!+7PLw%c?5!F)S^{7;nJI`RAf_SSolq7wO9=8h+&K3(2k z{LR;lrpP&(;J(C8AC_?U(y4@14I8zFqOQL zG?Wx&NdUq&3pBK%^5fJt>=f+t^ZY}Okwy0!QL+ilvLG&~SF5(oyTKb`VJ(~dy*jZ{ z3F$Gy4%a(5Cm*UjQR38Z{prvErjE%0S3IbGhn%ts=$=lBPJBt4{XI?wdZ1LqLsAvu z$ppPHK`XrZS^(5DdPS>vQxU!EPIE~II38X*`MTrRF>Y>PUnevSzAsm0IMwEO=|xIl zskh!>Acgnm8Wnt0OB7RzuRuQQn(tJ zYqu;E!jznxvpPD{0tRcoK&B55nVJTadgY|v!AedLPx5%fe&iB$>|1Bl`D%?VY-Y_+ z;S-%6`Z%_zJ?$}YU3oI8(UHcGaPpGNUkg&qD3@T>Ca5Q~L7WH*k=kI2JPzD3 zrP83ZJf0X8B(m7^3Z^BWBqu5IF#0Tv3vE6QLB^ffJM=U;Q~?7F6+7=MF)^8{x6Z$F zRVWi5LvRw`L>9AV)$bz=WlVH3lKbiy9hH#!41vRr0wNLPMI@x*@53=}J_Y~BFTRp+ za-#shLVs=7Z2)i)f;7%OfC7n|XJ;W1&2I$>4`OUOY&A{C3J0u$CuxCQP5LSW?OmdL z#GV^-Fj0#i%^B@ek#qn&6OG7YKUo5^8&Pw(at2Qwp*~~&lW)6iF6NvFYL=z zeKGev@o$g4)W_xn8|OOgqgrF^dZ-I62U7dZdkzk!D%1Z@EnwjLwhdGTR$&Ot-4c)o zMv5ruLG0$G^fSix%-$8_wm3QjzQJo2VqZqZe}X`1z`xgEC58+i{^5q-VkCaW!C(al zr-QV*w70JK{@2*1lKKWM>KJ2?eejqfvJ1w0iP+K}%&XGVWg3(je8A{Shm;I|A%t}h zgvyy%Tzll{-SOehRf(rgN(_o|aPdXL3pCCeK7bDI3CqCLNyy(;4&tH2sbkjAtN3!wSk7Ml5FoSvaQK?S1&_4odKsKpy8P8^jB$z5 zY571t^GRssKu>p29N?nHPL^=5W@W_bUvVs+@u34$?{t$W)+@o-lwTB&w{poCObKZ3 z4kpns`~+k^6BB%u-9)@k{Uj{7)i0s}q}2$v5Tu5dh3MPg=(cBhwZi4!H9Op=n7~~k z^_>X!&Q+-(uLbWUl@EXU$c%#Mm6f!y%@GyUU*Y?2bcCJTv*|iT2dEK?Jtq?4^+tIW zPC43Kvh4t1%S`V6DDWi8nWQm63`I`+SdEqb`&tGcsN$qhZ~`&r^aj|wji#THct1#}OZE#ylE#8!k4A;)1Hwj?$z*F0( zMm^^S6f*_#BitEeX-@e?8P{~1TFC%KMx_fFOcryE2x4iHg=J`b=2>D9s6^l*zZFb! zWNQup3gz9?o7f?VU*Vii1)yr};eH6I=$0Y=orAY+YAZB<&vlm6z(DnsH;(c=%1=`7 zr!o;ib@7C`KUg)nO2zhhHSv&fb_Z%Z3}Xo4^a+DC4dU2I=toWM6Pie_%i6-IGae<^ z`uV~gx+v6(^e%L1g&XFcSN>j=4&op_3;f==tXS{NSVPqNIOF8IEWcx*beg`AD6m2PQOijuRz;l3!F^sh<_gELoReaGBS4*7CMCtn#r;j%(MvJBGvN#g0<$9)N(06jRfQ@Vnuoe+-}vNAzGhMF1gL zT+6AX{e%)A-)JXjvlpDr$d>$!mqM%5(y98ylXs)L3NhNA{TR>7fJWNQOFdDh%Y)6P z^|6F?w_N?t*x0*ESBc8eNN<<+Q+Q;|rt6|$c7_wvE^RF6vEJqZXt zy4yt2VX@i?wwA7@Afr6S3pM)H{u1q~UOaD| zZYuLi7fagw8&1_)^g`5w(6Z@C6$KcZae2`~ACMFon2z*4uuS{Dc~J z=fX7`y{aGvdWT>!a{i1QwEFY8pHxBHap6s|eqJ%1=#f87Mn7D&$G@alKVYLSthf6PV6I-p|LV2dTMG-V!DP>r~d4>yEyq4Yy^H`5}F*pM@ev(1vGzfQHo zzJcb!ncaf-+=b`5pK2}T7@_c`X%Z^I%5?6U%Y_RVd_G{ZL4{-qzEMPyMj?vnx*TDL z8!z(X`_rkbPX_bvDELI%mtU*+&M#cUqhy+tf=Cw<)6B_{u4@QD+-^jN77AXtbsiJ4 zv!9D?Zhrc-P`|VZ)B810nyQZc5Kzeq4n2Vk2~I9xHzQKAYu7~{|D&!pkx+BzbyEhZ|BIc6`DwCd3nC*##mq$;3T>wr`AkmT%|O?IpRAX=f39G!F#< zJkErI27HyWpc_NNTzRZ5Ag#&yoc=*?MQQeFGzfV@Z|6S8PL;Q9q^y>WV$`kZTA)yo zjAKu0sB;9>_*~#_OW@#v)pKDhLKnlP*{8GX#rN4U(+kYPbh=mwvrID7=2>_!c8yH_ z(j$&o8g#FT4T(5C(S!ma?Q88^+xt;m{+7VXYn_?CKX6TxdO1hg#c5H#zllgWZ(NJk z6;jVok9m_+yLg=Z3yQ5+#Ez9+$*2|}gfpbQ@Mk-zMD9j}7^8C0kHo=QMNwJcmLQ5v zVi&}PlvO)cvY1I0oJs3Z(?V2i(EF_f{v~g4Lc|(SC?dm=8}=YI^~=uS&y7E(k=>bK zBZ=p)9Ysq}bfb@>_>Sr{x?Jf=^CHnN++>F&6bYAbLXv)psH2%RZq3GS$^l3eZ~~+3 z`b@WEh`UGg%Nko*;vGhy_L7e~$ks|!F{Qv`Q)H3rNL>MZV^t3Wq=FbaYMdLvOQ9NT z+kqfr;f?vskEM;?I1h2fvb88M*`%Q)JMd_Yvuvs^Htxr%`5TTp(M`e{O17I+`+i{` z8X`w*z8fWsZXrKP#Fc+Lnf@o0Fs7GxOg0^Et&X<% zMtHSZu*Y)lCTo!V9tpftnb7KmAphWTob2;|z zajlfuJppUUyB1JagoW=4ipNCkp!*fv-Rs?u5xbqrDCVi z`g)P1W7{Koux&|}G1HomB$SH%p^MQ*ru(-|Vx52-6W?j_r~ld?l$k*kv2ehJZDXG- z(q38E(Yrc31a@g^uBCDxLGxvGY4#_)YxyDvCr9HtLgmd3mD4oO-lga`jM$VMej`zH zH6uc^ZzzBAnzX#r}GC-9i8;F+XT2=%*qfMi42 z_q-v4uD*ZujoT_=@B=9Yi{b1!^LJwJC8|3b`_gSSsr+nBgPw}9ZW7DSU`TAI{7%|S z6##CafG0`~!aGYfn${J~DzAh*Z|>C9JZn>n(cQ-^)uBuo`2NIIe7nK*mMtSWy&M}R zgk?8Dbf;{~VaI4kZ549t$q>cWv1iN+y96A+H$X_Z;(2G9$ur~@z|ify+_xb+6hq{* zp`+@uKbWg`6Pa=_tV;A@H6Rj3h%KDu3if+j2k@>UU@8+AT+@9oW3Hx|K^(-3*SQ)VK-x^ih=e4=t7gF+ zob}o*G|dq`3KvYIdgj;IHCmJAbkI_Vvf_1U#E=&nv|8OQmlyyyWRl5 zIW2`9xOKoJ_gGpJ%PSLPGQ+O}jWuZQGB|fhq61tu~Cm9f{<|}I0)a#gU6t3EyPC?X4dkZ^It_W z7DP~R=Pv#(-~L40hGxaPWSu{1qQpm}^JK+NV?gG9oUk20Y07s#7{tl$yYl^pe_2>*1%jPp*fylfxLhRkb(S6P8!3iAT4)dsWoiBOo zi>=8?=p3WaQ=@cnH?A2Luylac(u4~ZYXX39XGV4;ScuLpw|3)SROv^$z?m_Prp~an zzw^ANBq-i3TD9e$pdoWgz)GL!t!f~K0C%bqmTNzC24BKWDzJO-(y=!LjH^cq;~=I` z$d>ZG2DUi4)UsMy6r!g{7{>b~3UlAw(7p@1Ui8A=`KP;V-K(e%KqcmQHpcm%aT>33 zB^1%g?{K_~CU}1^$x58OdCE)Zl_+`H1B#Fq_(@YYvQM65w%w&dncyEi5HQ(ehb{O% z&brL$$tzUoDV!XcT0=U);sdD;d@oH;$9ZP7J^dQJBavRGYl?pnKygR(bu2P; zB8>RBk6JHU+^R^c_YCqeb21R=0XiJIq{%6KSwQ^ zqMaNEN{Dxa*Kcq-y%1haGX5~sI*Onxqfh^=5YrheO=Ume!?!CcI)VJcc7ZUTEx#tH z#{T$F;l^HYBJ$%KpZ<^)B1VMtm{hJHWly37i5aJF3LA(Kir}J|bX{F${=_=$rtYew zym9dQhn2d5Zi^OH8KPa==wqeB25TB+gT~7N6RiYE`;3}f#%>PAE zdc0x0tbz!jkbI3;70!wwHH#LrECsqHS(L*jv%E9Q&g1mRI+3}c-&+f86LYp%;jLuo zEw=JmRb3s@kwH(ft@zypKxC*An6JA*{YL_Y5E8Hr}@mM%fJ+$VUw&#neYo+R6bDd?Dv_ z2c%e(W&-XRIRPxSN<_lcqkw{7y%koaUb`hp*rQfR#LDS%aTmO8H3~>IY?AUH*M(2Tz;X$>6gg5E-JEJ>LTT3G-gU>V9sp%f=xZ-ZVR;-Ja+P6*jUX5s3Sj zSivJtQAl00y8VcINi$ngOx>9o67rZ6eTYVC5&BDV*Yi0+A!+*a+uN!7rSIlJ*DwB-;i+oh=)rz z>*z;(IBEbt+xZNsEYTSVrGPrh0X^eJ=zl}_D-Zj>KHls_PO98}QC0^UOidUt<4&hO zXv5NDhsb)Jp=^KJheN$P-sC(0w9Pb9pxWCy_d*G@L^9yXQ%5dRuFBQ%Ze6&AuRjKwNsEd)|V48fW=q${-t2X2dgi z9lAHndTYnsy|dV$SNmPnw*^$=f%#EZv88dDgMV`;`${E3;=Bvu(ezI3!zh&!Iy#G& z${zd0)!qd*%wyrteX~TI?0=et7XQ1{l}fmU(*YlcWr|q!jb>*IS<+EE2>^jhy#RI> zZ9NK`Ko|I?UpvXF00v(~j%xx;)cPNF+gfi2956VWZyn>}D=MqVZ@p2_%SafE=DSK} zf4v^n$rqbA8|mQJVen|5xcn4NaPR8J)Gb%`Sr$;=$n20}RZx2rseOGFLjo7 zI4oYH)V#w!Rkb%GKAQLc9Jz3paa?_(>++z5upo7GbK`MuG{{5e%B@FP~VFZv4tPvpLImM=J zwZ2WP)|IBrZz6<6U#ttoYb-m=l0-78p{{0ukXma8C_>Y^s!8+|(^qVj{PXp0~U;MdQh5h(*$w%H8YRP^F zGO5G8*It&q?(L&y87` zK+i z$PNK}pCbeyno)#9l;<=AX3mvMm--NvZE|4n7_)Ho@nt`* z9s!49p*gNJt)KSVGMuK2&^BmhP%al$OvN=uTz8m4JjG8=ri0i!1f0!us zx4d&v2&Itr^-Or%$?`ri+r{nmrq52Y^g5N-5Jfk4!4hMyE8mZ}SJ8N-rt1nn&-U%U zV87~bJDfRJ9FKNwK?Lr|#6Y*cUHT>{dT+FXoYcwJ2;Q{4M9YLUp|Olei5|@^zocS# z{aB247@^k1^%_JANhO(hIs5?%BPaOhFyzdvlmL4@RUg-F)lgJ+Zv=&v6=^}dlDPBY z1{U1a=l>?Dgho?_DjcoART7+I>wguLFq+H*9IgjbXyPuHhQe02w4=K(vW9lPX6-m^ z)VbKB^BTVb9wwX>r`pp!qECOtQ1v9PJ{?te#VDUx1Jgg$PR!hj1)S(NCW2J zySm^3B^!QCE0E+z)crhU-6n^g3A(OYVe}-jBejB!lQ7N(d)=u8-~FL!kJcR@M+*`G z&~O-Nrcdlp$5Qt&rh7-*SV6Mw7aj`$h|$)e;s`E!8BUd?tPpq+n*~RV1chJ4imQAv zD)7==Q2v6Ic=H0za!GiY!O%)30RVnA#r*3fNFtB;+JmC|~y$YJ8eMw^ij5W%{okTm2>axV(tk0xw}X zD#OC~gRC6B-eTAwuVQ^Xfl1ubb&?6M9bTheYdkEZ*svC~G8rgPa`^0!Cor3_R2OUI z--KW~)w5BVFuSj?%KpU~9Zvfv5YoKDW{gGV$`c4|551LIzJ4N2t*K_P6naIY-DpZq zL#JuL1I+t1Ht^2weKF*K3zhzSf3aw9h3^~NRm_PpZ`lb%{HkObL8r2g?S-l?U+{fb z=3G&QgJ-Ex>`U^`YEi`-^Ce?+r-1?-}d1y%N0z4AA9G*mt+qjv}KiZ7@EN54V> zr+Mt(ZsI?hgnME~4xwA=a9NWz)>EB2g4HAu74vi8gES5N{HKL`+Zxt4^k+d&VS*fN z*v!$hR~%l(6_y6bM)J4y$=3%bziKU&(pykT1tS^CpnTw?+LHp133hkl!fc1cAk{$< z=yM41CRdmD#G!HPQb=*oRTQ|wwL*ZM{IRjsax++AT&qZA%C?pJH9;t` z-5Y6G817Bbr&~yuao=xRd+SN2u6+OmC7-t2UGSDOIsde^a>YB-4a7|Oo`N+l?e2XA zAaE5f5?HYV0j&!AY!=)@!+;IJ;%K@=TB0R3BdM3_!);k?McA8Ct}d&Rp4M9Helc~f zkLfbvqH$yYZnCF*M%8G{m$0&o8KwSszx^A(PR`)~uz(8(IOK>Xu*BGY>>OLM7=wwc zNptK{bJ#Cw3LJZ+z&Y%#mo&~EL_f;bj2e=wW?yA=#f2VTS^8@~`>`AAtPufn49{!u zcEWpRDqD0xKV}}y`f|`lYi2` z#!AvC3zyOo$P4o6!Y__K$VsaD7QYZ-PF(>Elx4L@!4ZYb3sXzj@ z%nQ`hKVfWbgcvyvaY#1cBi$u(|@~<0(i| z@@#6TjmM;iBqDzkC{a5K&;H6x-QdxtEA1YYV+XPC_eeW1n=-j!T^F>=p-RBzjtnA_ z($e?6#%rT7qxkQ`hBi_V4Yjt%x70;c7(=&BJd;fUi6F+y!VE#7q)vtZR%lK7%fFoN zllc8E?Xqq3)YnR)C_``bVzOGGB%4%q^ha zn7)2|4}RQXX7x=~h1)Ix(CkuaTaH#aumQ{(!&t=(4&BD_Rz%YqW9t zu^$N2W|BJl;SJ>a7Q;gjTHRgx<>Q6QW%A)+E!f5W{x91_E5aJmS@*K#vnei<#kIt; zVr6{TAU*gLBXPUb#3!Fqnd;yVHR7zRRa(wZI4nhbRWj7$#~XUY$^=TX37m&CWK7?$ ziTGuEq$e`*rQL)I30OD-wKF#(eM&l+ZcguVPf(FCiN(t{*{k#!?+jcx`SYd%UJ(Ub zy{@<=5kjLLCCf_dm@%mNw~tTxzdOT7l{e+FX&+?$+v)ne;P2>@8D`*M8MtxXp;sNY zgHQgFKw6bH2{<~kz)Lc`d7?!e2O9?vjg+bxaq>w3@KCFgJG1y3`q6dQx!gTco>%zc zt6&24?Dc+sj%x-=8P~SbkYh?0EW0D9LdlB+&gG# zkG%Tfl?a+c4+Z49^>MjC9)u7Ke4{iynD(c$wEBv1_O#%Wg=NcLgMDQm6rF~A2eaWHPOHbvS(A05hU^}lXQ4^*Apv|q0FFfwF9jQ9QBk z#L&Y}b+n)S#XX37d_yl{;ZthmOW#vP!L&{b`w1M#>-02#V|>kprSpKyfttTY|R^~a!S%0>=CQS5H6{BTJ)l-KAPW>qw-fwuy%o;BUofF79p*j)R|$?IuQRy&dnb?Jero1Xspob?1cY#dKkv260M?CHK>oF-B{U%j)UU- zc}&?{HZ7NouE?i2EfvAd1dT>9DD7r8N?dT)r45`$N*X2oUgzL)uBQw$1+MkHhqrO~ zw6uxQ*V-So-8D-sXhG1z$V!)nq9t2G!`mB~kGB3Mx6E=`6eZXvLvw=IDI#FRe-kjUHK~+V63R9G{sOgk&KJYqqamXdgnA!PR~Zv ztkWr1$8>DnXWYa*U&tAiDmtx;|?*TH|TKp)Cm6 zyQ%_-(XVk-2NP=@>bR!x7U>Q3hWndJdzMm5@X3804U#L8t*XG}WYtaHkMxV|hH~(D zeI8Q}5*XK!?0#;G>ryry^WF^OAT@Hgd{}6H|HUXJL9+BD$P;w-w6s|D3jW10X(O7L zG`-mzCa=_vvEVK`F<40-i`%4Uzfq$@ig7s@6wyYbwsC8J4qyN;2QRqld~^bBsAn>W z+j%DF3aifDa>jur0S@rIo!xiVo8dp%H6blAHac{Y&AAkXp1w)Kd84`EY3WclbGp8! zj5mn|KxN{9aRTW!+@}M8{kHzYD`?@i3@;0V%ao~R#WIUTFh*-hJx-g?C8#{+2a^(^ z+~;Z*jC5h@7Fks-0WA^*y&PRqQ*+1 z^aFO98IBVhjjhl2Xz#gEbv%^tGNYU^A7mS*l_A0Si8^n0sB#GUYi`cqe%*-c52#V& zlV^pQe7D0eZP`bl+oons3Lkmk#X?$E0{B>!U+(*Fp_6kq3uc(_dPZce`?43t=B27e z=noOE9FimClqN0(zaNP&K)Bs@gM}CW<`NqW1U^Yv4RWU5_nE#^;Iyb8@R2ii$|E1! zO;A_(vwPqs!iVJM6n>QDsu^iAEjq0s$~nq`w`z8Zb%*>MRi^~(bD3|+2(atoXPpHG z4hAr6Ljaott!Mk&71j)Wt_bsVigyPADvad+uJAo{iy~_Xn9oHWDg!(oqhPR~pmbf_ zP?biFg?R0z`z8}uh7OTQuhh|wP4z_T>GQu>b({3(kAVE(_2<`1iIfHC~dzi*vYURfa1B$kKBzV#i@A z-bPEYY$LhuYB^by>tbvJDCM2oQFd#&FwgZT-hHu;7dDmrcwA6kJ-sde;~K@KJi?I3 z@>`Y_;f^E{M5mBYAq~Q_s;&zgOuVR@RSXo~%x&7lTp%tm!`L+zb;N~wbIu}0nP7MY z?9k1Q4dJxipa)N|VgJnv9{c(ZHvVDr&n9GS(GRtycA&rN($Ht*J*#)|;6e!ju}!r2 zM)Jpf#tq2*das4c<$$Hoi%Np->IXGi7*uo>XDXF|GC?Ozrls^LJ%r!*cWzMWx3X4K z8E?i$-3aV0p8=#(Bg-r8Qo;y{0CrX4-$17KFSi?t+Qr~g88{LL*#zOkq>cLzB&VT3 zsboO~#>YKLX@^}N4w(~G5!RmWuG2_>WdxH4r0Q30>V;Yj$@=UVI;-aahOLzQJ*)2d zAvmfJ(NjwnkXeUcXtc7(n0x-JG^`1=!>!mmAy98U=HoNmo=lSvw`i;3J}>5>JQ%IG zlRM+k`_(>sAz2U4 zqnHkB5L!(16PJ9N!&p+R7!&Zp{aV`$$(PYaR#nOo1)#~iAa<8~0RIxa5cyVp%)B{B z9_=FTk9u8vpOC^+(wH3;m{ao>{T2ad%=!t%R=(zuzk)nnq?m4@LpDqy+|XknE{hQ~ zJ%fix^DXo}KuY1oMiYjjgy52iu!k~4q>WCZ-!TTo%7kw4lE!zrQ_k3$279}K#~Dsu zy)aV(0$W!8R8H%J4Yik;>=ZXiz^YbaSy7KQ8@Mi)gKL<7*o0leCL|uA%#V zNC9F&wK?8U0s)*n>q0}M}o zaV>7bT$Z#Bf-gwhaH8LHG4@3wc&-@V+|ru+0m=sNl}q8}%cIPR;3A9qV*ZrytQ~ zghSoFz;%DfAsO@_zVKMTlXS6e5$hY^2uZ2-`*R>kc`}8d$eq;4#d_!c`27!2edX2% ztG$M6+9gHM=nwS?AlsZ2RH?0j zM~e!_%^Tu)-;KBmZeKmY*J$c=JE~E9dG)UQfQbA$EaBHBZ#Kq$swEinj(vT=pUJA; z410p*NlqL_DyP>QeXU0Tm-5c}TNds~AVDfajM%fD^%~7}=KMgE+q;#)1L*DJX;*pq zQ)c>g%iW&uFKf-jbZf7?yiZdi!|)VKO+FHc}4RAJwY0ps(IZ&w18W&Kd{FtvJhLHYG%eIoI|DWn3k}v`rJn~DN zqB_=$4l6#|I~G{rfKbtl=$(3yRLW!03wym_l1TF+x=B3^P))mZtX+w35m*Y|_$qA# zc7N6EpvbBcR}&fRQl+ zpILpX_rDZL@$D4Q#&ZoRqZOsC@Kks4aH8MkrisLv(IVA=cMnyRT$`=rN_ ztr$8tp_)-ZjuNj0y7rQhT{jUFxeGJ92ecW$o$m0Z&|}{APA7TUz+cx8Y8U=C>Nx;Q zJ1syhEibXNS`%;ahnT*yj~2hBrabyMhXC|;88Rf(fE5x=x(AKf9hKjjC5Jo(sEa_g zH|jyrlm7-qI4}=42{=kSD87O-)5>|1MUcnwOLmV{RnBOmeC+|S4`1s>*}_XT z9ey6Nb+t+ZPwQyY6`MmY_Df-ax@fe9AyrUIQjJNQ2u2f$l~P6nm8FIe`bE1$G^y4O z{=RFT8*l+9iA6Y4ztcajsWDk|0^f*F#iMjd%wyir9EefzEEY8W>EkTia!K-x*&u|| z&w&sOGI^uidfoE}f6ttbF-!syxhXkxSC4PmjgdPE6B~!dzTgj_&8}@@7!%`j;<*Wz zveh>D-$t~Q8@}J~3PSo3O8>w(QwQLfw8Q!CC_9(;&vQ`8i)r-@=R?aq#~L5)gu;4K?K#+DL<-nFs8Z>ZAlJ?z zGkD+rD6N{L;B|2=8x!B99MD`8Eq(8o0iUy80tc9OZn_i*Hjhz6<1x#f$pRK2+`RzT z!_7QgMNEW$RwGO4c!4pA5Px=z2^q`#zL6lvWsZ2-`kAQ65T|=us$oSl2b_R|T_Qs&5I>M8k?)OgW_b_e2E@|0kppfz=&$EpSVpGO z4fhHpsS{e{79{`2J2$~&f?I;bXLJdm}-iQ?sXQxI;W9|o(WQd z{n{0;4=CyK`pkpR6Cx?vVR`?QDC0cu(ItN69$1+%(dxZ}D!sxp7$$a5YAmG6}8 zhyeL40@@5xEtb(q_}2nkN&&xeEOL6n9m#?1W-fiQva!Too!a$kHMsxyCe5 zyfuLbQf<7#Ix_K$DvFAA9v-DG501_kgF^R0RmEWWNkbfZfk(k2o2{z^Y4Zf6h<;_j zdSOHy>?<{EqO5|$#qnP7QW|}}FNzvqKfx~>Zs}W8edwGhWVl}=?@fK^N&zH2CVL^F ztK>a+Vy6C&A$Q{rrY5zvHZ3~&%kNI=N{4{TdrPxR5YMY4acGGGl#IznrQ~`DO|AH<;(w_2$ z!*g&pOJeTdXE{#z{0ny{Y^ucA(hdOGmjM}`s>1PS-*j-DL^fzg8h|6UE~ApiywhC<#a3b88#3E|10{!)t>Ps5DXL2aVLW$u>~ zRH=5B=A5O%K8~y+eds3dsJFFJGK7dZ;}BI46~nUJX5BgY`RqWC$)3EG)E*H~U0{Wy z(@2VO#S;DqtKb|w#wG>>w`|}hPlI`796zC?0u~@3^pRFA+cfzKRqHj+5Y>s0PxtRP z{fwZxM{uvBS%ev0+mCE0_WiiYSLk$2H}AAMz0X0WzI_oi6&rZH74m@}&rb;iJ!q~Z zr7aKxdGn(6C><3#daM%)Z3VL2jJ24OQ~CaNWaEjXRHOd;Y?oFf&pPESVtX$EVv*5P zlvroNHNKD?s<2%f=)iu!bO_ZEAM&P7&CVXO`Gb}8Sk6>0W)Pa{l2fVHrfgHquUJ6t z7kQnjek|9nU(EuV_Y0yoM`wvblTGSXAH_={l>qAy=_+(Lqfh`B%i6jApPe@j)B)Kz z0g3SqC0Qvu%b6TfATUG76W6CPPM07}G8XJQU3i~=>g(L$ULM@wLw_ONPTn09it!Y7 zy+DQW`!}JutAqcJBC57O7MLTn+3+x?lUgT@m#=#9t_8`rUuZ(uk>3egH2V9%LGbHyAJ!ic*0&EW+zq$ZJdm%;Jd2iWNH=c?tLGI56us0j`MpxLEMYJL8GC z2OV2`x!%!#74YhI9N#CiH%rs~pJjiFQ(GrT2-@yGAEMVQK-2EHps|n;qsf7Ta72#u z=_`riz5l1GvWhQ^3r1P>^7=JM?1vn;}a|O zzaepOZ@3WtSgoFH%uJ2)}7D> zFNw8TqcNNKq823Yc7m_OBl#g=iWLk}wK_h{J9e&VnadN_mWW6g-dH{cv?B1s{KB-+ zS7R^73nqo^9R*C9-dua#vENdZy<-X7J$@*DTqTFMaUmhvmubO>VJG`ANg-XoCud(r zoNThvqD@2yw5m8gp}kJl)7!)c`u7yeyU?%=2Hl$?EaxDUx6_`jUw=4-cc+;WO+v@& zKkYhNSKP6o{^-G-7^!9Q-X*?c+U8lojb-~STra;nDzX_9zLkl{g8q`V;3om+vmGu_ z&0om};)BWG13v5Lc8F%DW!w<}c4kar8Iky5RW?Gh>fcQd!%*6t3<_?8`J#v23{p8* zkKTQN8xMl@NlM>BKj#n}4usD4>f9=ldT+U)qz+n`Pl8ayof3zzHi^KR5KlJ zE3iH-IZ%dc?E|OS57c}57o=<$#=MsrQ0wb4m;(Tp>22@NnJZOmf(ON$^e+xxNTE!c zX%wxBlgfmhApOPj^y~^|D=`dE5)~2&5%Zkp8<|F_b9YF9KG;z+G3c1%jLRc=KVDsV zQC@9AUU!bK5>GL@J$GTe`>LoJ565{JpKJIe+#0+Y^%}0CG2)~(L>B{Kf~k%MlbH0T zA)ws?<>zV@jH6p-oPhSqMh-bpLDH|AR@Caxs-Du;1&QLjAAoKfytH%Jo9Gx#aNuTy z1F2SU1RmG~I*z0YN;3k=G6XqPkfEQn28U`K|9Nr$LwvkCiZX08IRY(Gn_9LH5h#|* zy0+!vGqfeP+kyv_OZH|Wrz+a$DrRwpf-jUeb$k1c^d%B!%Lj@B^r>sy{{3C-p*zr> zGFMcYAM_tqw{kl813(~B*IPkeaQ>ii1(HS8pJ42P47rn`k{W{1yZ`~Z~_(O`nebp5Q^B;0DV zF5lT384+We;_~?6dDB`Un?an_ua8DG$#YYJN?5zg(lQ2y)}mW~afJ%(n+_w`LzOSH zkcHp=U)r<5(m@#wO5`pkfw>Hcw3?v~1K20$7*#EUe_J^fNL zdYR`GC5emIr{QbZ?bUX6UiOq+yuu}uHwkEXZ=}S8S~6KwI@5^S_sCf+QthaP3C~7x z*6N6K(7r`z@)k-4T43SDLoul>MZ3g7jyN0>JCr9%j6QWxs%eSEzyKsXy)+H9Uo^E; z(hH1%`GUUIj$(RJ2hj}kq?9gJiWtD{PlFd0CUTJ9TdCo z$ktdCyG^ZcuEe z_;{!!bjfJxtW|ki+b~7?Y!G7P&SFsQXucWW}Oxk04bsuRX zpAd`=vp|Z*-6*o{r^MaMm>XuqE=^jd$4e2VnzZ;-G=#|h3*AOOaq0*bOORo{zW6c( zWeyVuAnzWDGAx)FQscrz=w2J-g!@YXu1CU%mpgMglh ziQ{obY$p`dh(NU_%`C`7+J8>wVK)TLu&jX&lU}sH!lKN~g)0#-`V2=VRQ}K z$jwT6;OEL&1`E}+%=OhK4ZSh};+o&N)Cm%v!M0Qd{6s>dM>|^0^Hmks^R{Q=T7lPZTxv&9Ir?W~Zzu>lLEc9VQuRjK8Abx!3uwul?Q$ zdP&1m)#(;W$BNe2&E&RQFw+?LyhAmoQu2&&*{6(-nTl~wk^<>`rL3pTVdH9LH)0u6 zqO3|44UWmi$qNn(tvt=c_C{8{(f{y5=dX8P7wy!%KtVFJeR)N;f|kG|x`m-J&l5}h zwf13-2j|o79GZu7()&fjQ$SK7P@lX~HGyRDNnn5@_*48vYe#C9*fnObcLgR!_)0{k z)0x)~USb0$QavMov==X*SgIPdB;e*8NX&aJmO zql)IJ1xG^1xE83P&%dh<0aoI&yJS4b;^f&S)WX7h z2{JG!q<XLaI-yZ8nG$3N31W(B%;OltEh!{>Q1-3-v%m%x|_@Js4^~oEu{8gKf zvl@-Xa_t?i{afTrL5=C;1w8R>)^@qN!{>_|zlbxkL>N^%0f~a2sPmd#DB1#~1e4{;8RqbwUd+i6*gj%Q`Ow+wHXAcRqb6E5+ zI+)gCR}fQQ$tR#Q>+a9n0{oRQ>%e9h{B>^H;Lvq$7Fr30vW#@AAx@#IsbM=wRlmDPGt8*`L<4abEy z<90)f6wK9qVnqK|Z$VB>gy|BG76HH+fM6>Zt^;ob`uL5QRo%`VkWG^kVXvvfoz|vK zw55m0JM+9(Ao^-Bf-Kqlwxda&*DX*3*VWn_cU8M?UUcn+A-EGGtTp%uF2dp3e~=b{ zB1HO7gno3>Fe8WD)iMX?{~!)5uiO_qY0m*K`N=G2k?YAugA3WAc0y8FjxIf>YFOmJ zd5aA;y4qimVK>@A63YqX?GHC)eBe95pp#zH<&{0R8d1B1hYW&;fKx9u?&9T8J{pEt876CUf_g>U)A}EezJkM9&_6*~ ztZEE5;UwFyl@+x!E%RbiJBg8kT$~0|7wllLPOtD9P!x6N6gpxXL3}e3pSUNQqXulc zd5M5Lfm>svfoobBlVQiOUK#W1L-Js0F~~Z-5MCOD+)aP0V9T6|djv3+o4vZm4wA3U z#Ygwu6WDe2!0sgYIqy! z*b5LAU^CE4D{MUpLRw*ZakWFIkdsmtr1RQcX&^6@h-7kMaoZWygyha{K2ub)5_EqY z>|B>Lfs1Z_hy73bhFsg{Mee0uWS%n^Zqw_C4vKt4sk%qJ&na;>k;6$A{i)2*SH{0x z)}mMH5Q`#HuN8D(LnK9UUM$udCkEz4iv;C;s3?&X1ACGD@%SU~uA2zBM8cy~yBC)_ zN_qbOR>rkj` zU?slo**E!wP>@FT!QRh6Ve=&%`O6zgl4rHgmfsJJK!Yp~VCgd1q^>(=nMMC^Nm2B6 zmnE!FC==?qDsw9AQ;Dtms-JSICIDyWEcQmoDcIh@ePbvzfK+A|mp(W3ZQ$Wwp)@#b zfzcY3`+bp%=4Jy+NOAOOgNffn@^cE@%3{_Ye&Q2?mY1PdtInIu4U?(dWb<94LNlP( zZ`M`+7j(i>XEbd2$vzkuH_=)IzgpZ&4Lf5aj_hTQ#`DT-oh@^+nr2>lG3^F}qs5La ziCh-nK~j9;AO%CyfKDC>AcxadpsUDRu;0Y+$XeDwHD%nMY`|d7c*V-bRtvu1^_`N+ zv?SL14LVO^AcaCXxHgy-2rXCPz8$wtyYA;$@f{``E(Fy7LNVX7-zh4kcjx{9iT=~s z==Bgyq97{055l+$r!vpqX;F(oKXznc2U-EQOj-0|(>-B4 z0K&#q@2{#&sNHQjVkP)PUMx}~&w89R1pI+0g3BKm!vNr8&H6WLf-> z*$x2>y_+22vGWnAV*gCxHe+8FdqiH0Idx@^9mw1m^jK(e6Rd-E0Q%`Q)O?||!RS29 zw@71nX!e$Bt^t5*8-9y8)tPdQo@xXi42>f(g#U~=DD!JU4J-FpP3V;W?#>X)^Ea)6 z8v8_J9+p-W4GQ5EP_CJ2*))7x0J?u0J%BdFKoLNa$p=%mcb&@XM?bl>mM{_uEd&wf zTyp5}^U~8V9>A-U23Oz$u<@|O>i);Js|`%=^|EDbtNcRha%|maHVMfdvDS=60`*p2(l-hme^hqU<39& zJ8&EpWrd4S&=U7^o9JpquXn*o7*zz%&{-)WIHTUx5d#74G&q_m4IF~UCbG!s1KuJro?uNa zUopv$a#_ot^ed-tw;`oLjBam5yU8fy%0~ zr64okc(@@0>@zK~GHKN*T>sGVgr3bHLBVA^0TANE<3l=RAk3{2C;0wDynhFtZUaQz z-5XXV{Hc}q1^}f}x_N9wg*-~ia#|0}B3;cRp~1X-5Yfk8kp!T&WE8|SSN(`R#ldx3697|hfJlA`p2$H`+N1u+4j%q%XXdj!vj7=yIf9yV;8|`zT!d;q?7ru)oMxx zeU7Gwp;0|AX;>TjlNdv5u8aT^YPe{CC;3LMCQ9}@A8eCyId4hR@_FxKBUNLHlmq1; zfnkOy(oIG!V{YM+Z#2UXt4kdc8#2KpVsv=^dt6uM4sO&?8Wrf%?B9IYS~>%to2yg@3cR`L$+R{3;C*P5h?MoF zqGsRyS)2**@NP#M*|tF4n(x`DTrkh8IxH+S{)?(kwVQk9n@He};(32Cb@k_3-0>*> zr2!53yHjL+E#gavEM-8JO=9+#zFKq?Cb&Ql7aCtFFo{nGZp!AN~;LEOxZVGYUQ zmA0q=IPZB^G0>w01sqj1mUiG@1ufjJ_rW3G0REWjCMo6q%pKd!3~ix`AgUI4q1NtF z>jU=jrI=Es9wWDZ=a_dYMJ_#asl7$8R*v-yHg&!prNG`%dcmxO%tLGx$d|?tb Date: Sun, 26 Jul 2026 13:37:10 +0530 Subject: [PATCH 021/127] updated chart-versions Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 52 +++++++++++++------ .../esignet-mosipid1-plugin-values-2-0-0.yaml | 28 +++++++++- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 28 +++++++++- .../esignet-plugin-values-2-0-0.yaml | 28 +++++++++- .../esignet-sunbird-plugin-values-2-0-0.yaml | 22 ++++++++ 5 files changed, 139 insertions(+), 19 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 14a0be2d1..55e650580 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -108,12 +108,12 @@ apps: esignet-go-mock: namespace: esignet-go-mock enabled: true - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/esignet valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml" set: - image.repository: "mosipqa/esignet-with-plugins" - image.tag: "develop" + image.repository: "mosipqa/esignet" + image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" activeProfileEnv: "" @@ -131,6 +131,7 @@ apps: domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-go.${domain_name}" timeout: 600 priority: -14 hooks: @@ -140,12 +141,12 @@ apps: esignet-go-mosipid1: namespace: esignet-go-mosipid1 enabled: true - version: 0.1.0-develop + version: 2.0.0-develop chart: mosip/esignet valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml" set: - image.repository: "mosipqa/esignet-with-plugins" - image.tag: "develop" + image.repository: "mosipqa/esignet" + image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" activeProfileEnv: "" @@ -172,6 +173,7 @@ apps: domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid1.${domain_name}" domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid1.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid1.${domain_name}" timeout: 600 priority: -14 hooks: @@ -180,12 +182,12 @@ apps: esignet-go-mosipid2: namespace: esignet-go-mosipid2 enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/esignet valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml" set: - image.repository: "mosipqa/esignet-with-plugins" - image.tag: "develop" + image.repository: "mosipqa/esignet" + image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" activeProfileEnv: "" @@ -212,6 +214,7 @@ apps: domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid2.${domain_name}" domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid2.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid2.${domain_name}" timeout: 600 priority: -14 hooks: @@ -220,12 +223,12 @@ apps: esignet-go-sunbird: namespace: esignet-go-sunbird enabled: true - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/esignet valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml" set: - image.repository: "mosipqa/esignet-with-plugins" - image.tag: "develop" + image.repository: "mosipqa/esignet" + image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" activeProfileEnv: "" @@ -246,6 +249,7 @@ apps: domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" + domainConfig.OIDC_UI_HOSTNAME: "esignet-go-sunbird.${domain_name}" timeout: 600 priority: -14 hooks: @@ -261,7 +265,7 @@ apps: chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" - image.tag: "develop" + image.tag: "develop-go" istio.hosts[0]: "esignet-go.${domain_name}" oidc_ui.oidc_service_host: "esignet-go-mock.esignet-go-mock" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" @@ -278,7 +282,7 @@ apps: chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" - image.tag: "develop" + image.tag: "develop-go" istio.hosts[0]: "esignet-go-mosipid1.${domain_name}" oidc_ui.oidc_service_host: "esignet-go-mosipid1.esignet-go-mosipid1" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" @@ -295,7 +299,7 @@ apps: chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" - image.tag: "develop" + image.tag: "develop-go" istio.hosts[0]: "esignet-go-mosipid2.${domain_name}" oidc_ui.oidc_service_host: "esignet-go-mosipid2.esignet-go-mosipid2" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" @@ -312,7 +316,7 @@ apps: chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" - image.tag: "1.8.x" + image.tag: "develop-go" istio.hosts[0]: "esignet-go-sunbird.${domain_name}" oidc_ui.oidc_service_host: "esignet-go-sunbird.esignet-go-sunbird" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" @@ -377,6 +381,8 @@ apps: version: 0.0.1-develop chart: mosip/mock-relying-party-service set: + image.repository: "mosipqa/mock-relying-party-service" + image.tag: "develop-go" mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" @@ -392,6 +398,8 @@ apps: version: 0.0.1-develop chart: mosip/mock-relying-party-service set: + image.repository: "mosipqa/mock-relying-party-service" + image.tag: "develop-go" mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" @@ -407,6 +415,8 @@ apps: version: 0.0.1-develop chart: mosip/mock-relying-party-service set: + image.repository: "mosipqa/mock-relying-party-service" + image.tag: "develop-go" mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" @@ -422,6 +432,8 @@ apps: version: 0.0.1-develop chart: mosip/mock-relying-party-service set: + image.repository: "mosipqa/mock-relying-party-service" + image.tag: "develop-go" mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" @@ -437,6 +449,8 @@ apps: version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: + image.repository: "mosipqa/mock-relying-party-ui" + image.tag: "develop-go" mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go.${domain_name}" mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go.esignet-go-mock" mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go.${domain_name}" @@ -457,6 +471,8 @@ apps: version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: + image.repository: "mosipqa/mock-relying-party-ui" + image.tag: "develop-go" mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-mosipid1.${domain_name}" mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-mosipid1.esignet-go-mosipid1" mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-mosipid1.${domain_name}" @@ -477,6 +493,8 @@ apps: version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: + image.repository: "mosipqa/mock-relying-party-ui" + image.tag: "develop-go" mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-mosipid2.${domain_name}" mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-mosipid2.esignet-go-mosipid2" mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-mosipid2.${domain_name}" @@ -497,6 +515,8 @@ apps: version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: + image.repository: "mosipqa/mock-relying-party-ui" + image.tag: "develop-go" mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-sunbird.${domain_name}" mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-sunbird.esignet-go-sunbird" mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-sunbird.${domain_name}" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 21dbe3d58..4809e673d 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -61,7 +61,33 @@ extraEnvVars: secretKeyRef: name: keycloak-client-secrets-mosipid1 key: mosip_ida_client_secret - + - name: AUTHN_PROVIDER + value: mosip + - name: MOSIP_P12_PATH + value: /home/mosip/keys/secret/esignet.pfx + - name: MOSIP_P12_PASSWORD + value: localtest + - name: OIDC_UI_SCHEME + value: https + - name: CRYPTO_ENCRYPTION_KEY + value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + - name: OIDC_UI_HOSTNAME + valueFrom: + configMapKeyRef: + name: esignet-global + key: mosip-esignet-host + - name: OIDC_UI_PORT + value: '443' + - name: OIDC_UI_LOGIN_PATH + value: /signin + - name: OIDC_UI_ERROR_PATH + value: /error + - name: DEFAULT_THEME_ID + value: decl-theme-1 + - name: DEFAULT_LAYOUT_ID + value: decl-layout-1 + - name: DEFAULT_AUTH_FLOW_ID + value: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" value: "esignetmosipid1" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 68d3d08b2..06ab3dbc6 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -59,7 +59,33 @@ extraEnvVars: secretKeyRef: name: keycloak-client-secrets-mosipid2 key: mosip_ida_client_secret - + - name: AUTHN_PROVIDER + value: mosip + - name: MOSIP_P12_PATH + value: /home/mosip/keys/secret/esignet.pfx + - name: MOSIP_P12_PASSWORD + value: localtest + - name: OIDC_UI_SCHEME + value: https + - name: CRYPTO_ENCRYPTION_KEY + value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + - name: OIDC_UI_HOSTNAME + valueFrom: + configMapKeyRef: + name: esignet-global + key: mosip-esignet-host + - name: OIDC_UI_PORT + value: '443' + - name: OIDC_UI_LOGIN_PATH + value: /signin + - name: OIDC_UI_ERROR_PATH + value: /error + - name: DEFAULT_THEME_ID + value: decl-theme-1 + - name: DEFAULT_LAYOUT_ID + value: decl-layout-1 + - name: DEFAULT_AUTH_FLOW_ID + value: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" value: "esignetmosipid2" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index bc12b19e7..c6559737f 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -73,7 +73,33 @@ extraEnvVars: secretKeyRef: name: keycloak-client-secrets key: mosip_ida_client_secret - + - name: AUTHN_PROVIDER + value: mosip + - name: MOSIP_P12_PATH + value: /home/mosip/keys/secret/esignet.pfx + - name: MOSIP_P12_PASSWORD + value: localtest + - name: OIDC_UI_SCHEME + value: https + - name: CRYPTO_ENCRYPTION_KEY + value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + - name: OIDC_UI_HOSTNAME + valueFrom: + configMapKeyRef: + name: esignet-global + key: mosip-esignet-host + - name: OIDC_UI_PORT + value: '443' + - name: OIDC_UI_LOGIN_PATH + value: /signin + - name: OIDC_UI_ERROR_PATH + value: /error + - name: DEFAULT_THEME_ID + value: decl-theme-1 + - name: DEFAULT_LAYOUT_ID + value: decl-layout-1 + - name: DEFAULT_AUTH_FLOW_ID + value: decl-mosip-otp-flow-1 # extraEnvVarsCM: # - esignet-softhsm-share diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index cf9545001..d579720f6 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -61,6 +61,28 @@ extraEnvVars: secretKeyRef: name: keycloak-client-secrets key: mosip_ida_client_secret + - name: AUTHN_PROVIDER + value: mosip + - name: MOSIP_P12_PATH + value: /home/mosip/keys/secret/esignet.pfx + - name: MOSIP_P12_PASSWORD + value: localtest + - name: OIDC_UI_SCHEME + value: https + - name: CRYPTO_ENCRYPTION_KEY + value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + - name: OIDC_UI_PORT + value: '443' + - name: OIDC_UI_LOGIN_PATH + value: /signin + - name: OIDC_UI_ERROR_PATH + value: /error + - name: DEFAULT_THEME_ID + value: decl-theme-1 + - name: DEFAULT_LAYOUT_ID + value: decl-layout-1 + - name: DEFAULT_AUTH_FLOW_ID + value: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" From 6a64fc375fe23d205d8f875c4e39c177ebfe4665 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 27 Jul 2026 00:13:17 +0530 Subject: [PATCH 022/127] fix: #302 Fix broken YAML in esignet-plugin-values-2-0-0.yaml: a block of extraEnvVars entries appended by the chart-versions update used 2-space list indentation while the rest of the file's extraEnvVars sequence uses 1-space indentation, causing "did not find expected '-' indicator" on deploy. Re-indented to match. Also removes the OIDC_UI_HOSTNAME entry (sourced from the esignet-global configmap) from the base, mosipid1, and mosipid2 plugin-values files. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 5 -- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 5 -- .../esignet-plugin-values-2-0-0.yaml | 49 +++++++++---------- 3 files changed, 22 insertions(+), 37 deletions(-) diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 4809e673d..efeb38505 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -71,11 +71,6 @@ extraEnvVars: value: https - name: CRYPTO_ENCRYPTION_KEY value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e - - name: OIDC_UI_HOSTNAME - valueFrom: - configMapKeyRef: - name: esignet-global - key: mosip-esignet-host - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 06ab3dbc6..6f4317522 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -69,11 +69,6 @@ extraEnvVars: value: https - name: CRYPTO_ENCRYPTION_KEY value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e - - name: OIDC_UI_HOSTNAME - valueFrom: - configMapKeyRef: - name: esignet-global - key: mosip-esignet-host - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index c6559737f..699de0f37 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -73,33 +73,28 @@ extraEnvVars: secretKeyRef: name: keycloak-client-secrets key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx - - name: MOSIP_P12_PASSWORD - value: localtest - - name: OIDC_UI_SCHEME - value: https - - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e - - name: OIDC_UI_HOSTNAME - valueFrom: - configMapKeyRef: - name: esignet-global - key: mosip-esignet-host - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 + - name: AUTHN_PROVIDER + value: mosip + - name: MOSIP_P12_PATH + value: /home/mosip/keys/secret/esignet.pfx + - name: MOSIP_P12_PASSWORD + value: localtest + - name: OIDC_UI_SCHEME + value: https + - name: CRYPTO_ENCRYPTION_KEY + value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + - name: OIDC_UI_PORT + value: '443' + - name: OIDC_UI_LOGIN_PATH + value: /signin + - name: OIDC_UI_ERROR_PATH + value: /error + - name: DEFAULT_THEME_ID + value: decl-theme-1 + - name: DEFAULT_LAYOUT_ID + value: decl-layout-1 + - name: DEFAULT_AUTH_FLOW_ID + value: decl-mosip-otp-flow-1 # extraEnvVarsCM: # - esignet-softhsm-share From a084c20efc1d162a87e513d093e0498c1203319f Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 27 Jul 2026 10:46:14 +0530 Subject: [PATCH 023/127] fix: #302 Make mosipid2_domain_name optional in helmsman_testrigs.yml, matching helmsman_esignet.yml's handling: add an enable_mosipid2 toggle, drop the unconditional hard-requirement on mosipid1/mosipid2_domain_name in validate-inputs (now echo-only, consistent across both workflows), and gate the mosipid2 apitestrig's enabled field in both testrigs-dsf.yaml files behind MOSIPID2_ENABLED instead of hardcoding it to true. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .github/workflows/helmsman_testrigs.yml | 28 +++++++++++++------ .../testrigs-dsf.yaml | 2 +- .../dsf/esignet-standalone/testrigs-dsf.yaml | 2 +- 3 files changed, 21 insertions(+), 11 deletions(-) diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 3aa92a77d..8a2c5395b 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -29,8 +29,13 @@ on: description: "MOSIP-ID1 domain name (e.g. mosipenv1.xyz.net) — required for esignet profile" required: false type: string + enable_mosipid2: + description: "Enable MOSIP-ID2 testrig (only needed if mosipid2 eSignet instance is enabled)" + required: false + default: false + type: boolean mosipid2_domain_name: - description: "MOSIP-ID2 domain name (e.g. mosipenv2.xyz.net) — required for esignet profile" + description: "MOSIP-ID2 domain name (e.g. mosipenv2.xyz.net) — required only when enable_mosipid2 is set" required: false type: string db_port: @@ -81,12 +86,6 @@ jobs: [ -z "$SLACK_CH" ] && errors+=("slack_channel_name is empty — set vars.SLACK_CHANNEL_NAME under Environment '${{ github.ref_name }}'") [ -z "$DB_PORT" ] && errors+=("db_port is empty — set vars.DB_PORT under Environment '${{ github.ref_name }}'") [ -z "$ESIGNET_DB_PORT" ] && errors+=("esignet_db_port is empty — set vars.ESIGNET_DB_PORT under Environment '${{ github.ref_name }}'") - if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then - MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" - MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" - [ -z "$MOSIPID1_DOMAIN" ] && errors+=("mosipid1_domain_name is empty — set vars.MOSIPID1_DOMAIN_NAME under Environment '${{ github.ref_name }}'") - [ -z "$MOSIPID2_DOMAIN" ] && errors+=("mosipid2_domain_name is empty — set vars.MOSIPID2_DOMAIN_NAME under Environment '${{ github.ref_name }}'") - fi if [ ${#errors[@]} -gt 0 ]; then echo "❌ Required variables missing:" printf ' - %s\n' "${errors[@]}" @@ -98,9 +97,19 @@ jobs: echo "✓ slack_channel_name = $SLACK_CH" echo "✓ db_port = $DB_PORT" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" + # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. + # Push events always target the esignet profile (path filter); dispatch uses explicit profile input. if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then - echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet profile)" - echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet profile)" + MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" + MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" + echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" + echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" + else + MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" + MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" + if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then + echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" + fi fi deploy: @@ -115,6 +124,7 @@ jobs: domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} + MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} db_port: ${{ github.event.inputs.db_port || vars.DB_PORT }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index b5d29dc53..f243acad9 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -125,7 +125,7 @@ apps: # --------------------------------------------------------------------------- esignet-go-mosipid2-apitestrig: namespace: esignet-go-mosipid2 - enabled: true + enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/apitestrig valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" diff --git a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml index b6d8a16f8..d07899ae8 100644 --- a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml @@ -125,7 +125,7 @@ apps: # --------------------------------------------------------------------------- esignet-mosipid2-apitestrig: namespace: esignet-mosipid2 - enabled: true + enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/apitestrig valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" From 607fcf76fa6f1a1a715fd0bc5191dcaa45128a93 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 4 Aug 2026 17:09:40 +0530 Subject: [PATCH 024/127] fix: 2288 correct captcha version, module names, P12 paths, and mock-rp OIDC config - Bump captcha chart to 0.1.1 to match the deployed version - Give each esignet instance a unique captcha module name (esignetgomosipid1/2, esignetgosunbird) - Fix MOSIP_P12_PATH filenames per instance (mosipid1.pfx, mosipid2.pfx, mock.pfx, sunbird.pfx) - Remove duplicate MOSIP_ESIGNET_CAPTCHA_MODULE_NAME entry from mosipid1 extraEnvVars - Add mock-relying-party-ui OIDC client config (CLIENT_ID, ACRS, DISPLAY, GRANT_TYPE, CLAIMS_LOCALES, SCOPE_USER_PROFILE, CLAIMS_USER_PROFILE, CLAIMS_REGISTRATION, FALLBACK_LANG, AUTHORIZE_ENDPOINT, CODE_CHALLENGE) across all instances in both esignet-standalone and esignet-standalone-2.0.0 profiles - Add mock-relying-party-service valuesFile (mock-replying-party.yaml) with PAR-related extraEnvVars, wired into all 4 mock-relying-party-service-go* apps https://github.com/mosip/esignet/issues/2288 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 143 +++++++++++++----- .../dsf/esignet-standalone/esignet-dsf.yaml | 56 +++++++ .../dsf/esignet-standalone/external-dsf.yaml | 2 +- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 6 +- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 4 +- .../esignet-plugin-values-2-0-0.yaml | 4 +- .../esignet-sunbird-plugin-values-2-0-0.yaml | 4 +- .../mock-replying-party.yaml | 25 +++ 8 files changed, 198 insertions(+), 46 deletions(-) create mode 100644 Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 55e650580..9ce3a8826 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -103,7 +103,7 @@ apps: postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh" # --------------------------------------------------------------------------- - # eSignet v1.7.1 + # eSignet # --------------------------------------------------------------------------- esignet-go-mock: namespace: esignet-go-mock @@ -122,11 +122,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -155,11 +155,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid1-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid1.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid1.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid1.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid1.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid1_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -196,11 +196,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid2-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid2.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid2.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid2.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid2.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid2_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -237,11 +237,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-sunbird-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-sunbird.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-sunbird.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-sunbird.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-sunbird.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -256,12 +256,12 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh" # --------------------------------------------------------------------------- - # OIDC UI v1.7.1 + # OIDC UI # --------------------------------------------------------------------------- oidc-ui-go: namespace: esignet-go-mock enabled: true - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -270,6 +270,7 @@ apps: oidc_ui.oidc_service_host: "esignet-go-mock.esignet-go-mock" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mock.esignet-go-mock" + timeout: 1200 priority: -13 hooks: @@ -278,7 +279,7 @@ apps: oidc-ui-go-mosipid1: namespace: esignet-go-mosipid1 enabled: true - version: 0.1.0-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -295,7 +296,7 @@ apps: oidc-ui-go-mosipid2: namespace: esignet-go-mosipid2 enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -312,7 +313,7 @@ apps: oidc-ui-go-sunbird: namespace: esignet-go-sunbird enabled: true - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -380,11 +381,15 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -397,11 +402,15 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -414,11 +423,15 @@ apps: enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" - image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth/v2/token" + image.tag: "develop-go" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -431,11 +444,15 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-sunbird.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -458,6 +475,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go.${domain_name}" wait: true timeout: 480 @@ -480,6 +511,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid1.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go-mosipid1.${domain_name}" wait: true timeout: 480 @@ -502,6 +547,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid2.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go-mosipid2.${domain_name}" wait: true timeout: 480 @@ -524,6 +583,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-sunbird.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go-sunbird.${domain_name}" wait: true timeout: 480 diff --git a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml index bdeb831ef..5db2e94be 100644 --- a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml @@ -443,6 +443,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices.${domain_name}" wait: true timeout: 480 @@ -463,6 +477,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-mosipid1.${domain_name}" wait: true timeout: 480 @@ -483,6 +511,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-mosipid2.${domain_name}" wait: true timeout: 480 @@ -503,6 +545,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-sunbird.${domain_name}" wait: true timeout: 480 diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index c25538342..f44e721d9 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -512,7 +512,7 @@ apps: captcha: namespace: captcha enabled: true - version: 0.1.0-beta.1 + version: 0.1.1 chart: mosip/captcha set: metrics.serviceMonitor.enabled: "false" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index efeb38505..697de99b0 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -9,8 +9,6 @@ extraEnvVars: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet - name: REDIS_HOST valueFrom: configMapKeyRef: @@ -64,7 +62,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/mosipid1.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME @@ -85,7 +83,7 @@ extraEnvVars: value: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetmosipid1" + value: "esignetgomosipid1" - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" valueFrom: secretKeyRef: diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 6f4317522..96e42db3e 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -62,7 +62,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/mosipid2.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME @@ -83,7 +83,7 @@ extraEnvVars: value: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetmosipid2" + value: "esignetgomosipid2" - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" valueFrom: secretKeyRef: diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index 699de0f37..6f53b8731 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -22,7 +22,7 @@ extraEnvVars: name: esignet-captcha-go key: esignet-captcha-site-key - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet + value: esignetgo - name: REDIS_HOST valueFrom: configMapKeyRef: @@ -76,7 +76,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/mock.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index d579720f6..54f52350c 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -10,7 +10,7 @@ extraEnvVars: name: keycloak-host key: keycloak-external-url - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet + value: esignetgosunbird - name: REDIS_HOST valueFrom: configMapKeyRef: @@ -64,7 +64,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/sunbird.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml new file mode 100644 index 000000000..152594a8b --- /dev/null +++ b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml @@ -0,0 +1,25 @@ +extraEnvVars: + - name: CLIENT_ID + value: I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM + - name: ACRS + value: >- + mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge + - name: DISPLAY + value: page + - name: GRANT_TYPE + value: authorization_code + - name: CLAIMS_LOCALES + value: en + - name: SCOPE_USER_PROFILE + value: openid profile + - name: CLAIMS_USER_PROFILE + value: >- + {"userinfo":{"given_name":{"essential":true},"phone_number":{"essential":true},"email":{"essential":true},"picture":{"essential":false},"gender":{"essential":false},"birthdate":{"essential":false},"address":{"essential":false}},"id_token":{}} +mock_relying_party_service: + host: '' + mountDir: "" # path inside docker + healthCheckUrl: + mock_relying_party_serviceMountDIr: /home/mosip/oidc/ + puburl: + privurl: + USERINFO_RESPONSE_TYPE: jwt From 411fb31d4081fbd089dc883d6714488998216742 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 4 Aug 2026 17:36:54 +0530 Subject: [PATCH 025/127] docs: document esignet-standalone-2.0.0 differences in deployment guide Add inline notes throughout ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md covering the esignet-standalone-2.0.0 (Go) profile alongside the existing esignet-standalone (v1.7.1) instructions: - -go namespace/hostname equivalents in the instances table - shared mosipid1/mosipid2 domain variables and captcha/signup secrets (no separate _GO secrets) across both profiles - profile dropdown values per workflow step, noting Step 1 (external services) always uses esignet-standalone regardless of which esignet profile is deployed - verification commands and expected URLs side by side for both profiles - MOSIP ID onboarding note on allowed-domain-uris when both profiles point at the same remote MOSIP environment Signed-off-by: bhumi46 --- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 100 +++++++++++++++++--- 1 file changed, 87 insertions(+), 13 deletions(-) diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index ee2e06e61..4340b2245 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -52,6 +52,9 @@ This deployment can run up to **4 separate eSignet instances** on the same clust | **eSignet MOSIP-ID2** | `esignet-mosipid2` | A second real MOSIP identity system at `MOSIPID2_DOMAIN_NAME` | No | | **eSignet Sunbird** | `esignet-sunbird` | A Sunbird RC credential registry | Yes | +> **Deploying `esignet-standalone-2.0.0` instead?** Same 4 instances, `-go`-suffixed namespaces: +> `esignet-go-mock`, `esignet-go-mosipid1`, `esignet-go-mosipid2`, `esignet-go-sunbird`. + ### When do you need mosipid1? Use `esignet-mosipid1` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID1_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. @@ -74,6 +77,11 @@ If you only have one MOSIP system to connect to, leave mosipid2 disabled. You do > No DSF file edits needed — `enable_mosipid2` is a workflow input toggle that controls deployment at runtime. +> **`esignet-standalone-2.0.0` note:** `MOSIPID1_DOMAIN_NAME` and `MOSIPID2_DOMAIN_NAME` are the same variables +> used by both profiles — if you run `esignet-standalone` and `esignet-standalone-2.0.0` side by side, their +> mosipid1/mosipid2 instances point at the **same** remote MOSIP environment(s). There's no separate `_GO`-suffixed +> domain variable. + --- ## 1. Before You Start @@ -148,6 +156,12 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the main `esignet-mock` namespace | | `ESIGNET_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the main `esignet-mock` namespace | +> **`esignet-standalone-2.0.0` note:** `helmsman_external.yml` has no `esignet-standalone-2.0.0` option in its +> `profile` dropdown — it only ever deploys as `esignet-standalone`. The 2.0.0 profile has no `external-dsf.yaml` +> of its own; it reuses this same shared captcha/Postgres/Keycloak/Redis/Kafka/MinIO deployment (see the callout +> at the top of this guide). Always run Step 1 with `profile: esignet-standalone`, even if you only plan to +> deploy `esignet-standalone-2.0.0` in Step 2. + **For `helmsman_esignet.yml`:** | Secret Name | What it is | @@ -167,6 +181,13 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings > ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. +> **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0` +> — there are no separate `_GO`-suffixed GitHub secrets. Internally, the 2.0.0 hooks create differently-named +> Kubernetes secrets (e.g. `esignet-captcha-go`, `esignet-captcha-go-mosipid1`) and patch differently-named env +> vars onto the shared `captcha` deployment (e.g. `MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO`) so both +> profiles can coexist on the same captcha pod — but the underlying reCAPTCHA key **values** you configure here +> are shared between `esignet-standalone` and `esignet-standalone-2.0.0`. + **For `helmsman_signup.yml` (set now even though signup is not yet active):** | Secret Name | What it is | @@ -174,6 +195,9 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `MOSIP_SIGNUP_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the `signup` namespace | | `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the `signup` namespace | +> **`esignet-standalone-2.0.0` note:** Same secrets reused here too — signup for the 2.0.0 profile deploys into +> the `signup-go` namespace (vs `signup` for `esignet-standalone`) but shares these same GitHub secret values. + --- ### C. Environment Variables @@ -206,12 +230,16 @@ Step 0 → Provision Infrastructure (terraform plan / apply) ├── 0b base-infra ~10 min ← once per AWS account; skip if already done ├── 0c observ-infra ~15 min ← optional monitoring cluster └── 0d infra ~20 min profile: esignet-standalone ← the main cluster -Step 1 → Deploy External Services (helmsman_external.yml) ~20 min -Step 2 → Deploy eSignet (helmsman_esignet.yml) ~25 min +Step 1 → Deploy External Services (helmsman_external.yml) ~20 min profile: esignet-standalone (always) +Step 2 → Deploy eSignet (helmsman_esignet.yml) ~25 min profile: esignet-standalone or esignet-standalone-2.0.0 Step 3 → Deploy Signup (helmsman_signup.yml) ⚠️ IN PROGRESS — not ready yet -Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min +Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min profile: esignet-standalone or esignet-standalone-2.0.0 ``` +> Steps 2–4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy the +> Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both profiles +> share the same external infrastructure. + --- ### Step 0 — Provision Infrastructure (Terraform) @@ -349,7 +377,7 @@ All pods should show `Running` or `Completed`. | Field | Value to enter | |---|---| -| `profile` | `esignet-standalone` | +| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — see note below | | `mode` | `apply` | | `skip_mosip_dsf_check` | **tick this** — standalone has no MOSIP deployment to wait for | | `delete_existing_jobs` | tick only if re-running after a failure; leave unticked on first deploy | @@ -362,16 +390,34 @@ All pods should show `Running` or `Completed`. > **Important:** Always tick `skip_mosip_dsf_check` for standalone eSignet — without it, the workflow waits for a `mosip-dsf=completed` namespace label that will never appear (there is no full MOSIP deployment in this mode), and the workflow will fail. +> **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml` +> instead — it deploys the same 4 instances (main/mock, mosipid1, mosipid2, sunbird) plus their OIDC UIs and mock +> relying party service, but into `-go`-suffixed namespaces (`esignet-go-mock`, `esignet-go-mosipid1`, +> `esignet-go-mosipid2`, `esignet-go-sunbird`) with `-go`-suffixed hostnames (e.g. `esignet-go.sandbox.xyz.net`). +> All other fields (`domain_name`, `mosipid1_domain_name`, `enable_mosipid2`, etc.) work the same way as for +> `esignet-standalone`. You can run both profiles side by side in the same cluster — Step 1 only needs to be run +> once, with `profile: esignet-standalone`. + 4. Click the green **`Run workflow`** button ![Deploy eSignet - Helmsman](_images/esignet.png) **How to know it succeeded:** + +For `esignet-standalone`: ```bash kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird # If enable_mosipid2 was set to true: kubectl get pods -n esignet-mosipid2 ``` + +For `esignet-standalone-2.0.0`: +```bash +kubectl get pods -n esignet-go-mock && kubectl get pods -n esignet-go-mosipid1 && kubectl get pods -n esignet-go-sunbird +# If enable_mosipid2 was set to true: +kubectl get pods -n esignet-go-mosipid2 +``` + All pods should show `Running`. --- @@ -385,6 +431,10 @@ All pods should show `Running`. > **What you need to do right now:** Nothing — skip this step for now. However, make sure the signup secrets (`MOSIP_SIGNUP_CAPTCHA_SITE_KEY` and `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY`) are already added to the GitHub Environment (see Section 2) so you are ready when signup is enabled. > > This section will be updated with full instructions once signup deployment is ready. +> +> **`esignet-standalone-2.0.0` note:** `helmsman_signup.yml` already lists `esignet-standalone-2.0.0` in its +> `profile` dropdown (deploys into the `signup-go` namespace instead of `signup`), but it's equally not-yet-ready +> for either profile. --- @@ -402,7 +452,7 @@ All pods should show `Running`. | Field | Value to enter | |---|---| -| `profile` | `esignet-standalone` | +| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — matches whichever profile you deployed in Step 2 | | `mode` | `apply` | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | | `mosipid1_domain_name` | MOSIP-ID1 base domain *(if MOSIP-ID1 was deployed in Step 2)* | @@ -417,11 +467,23 @@ All pods should show `Running`. ![Deploy Test Rigs - Helmsman](_images/helmsman-testrigs.png) **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created: + +For `esignet-standalone`: ```bash kubectl get cronjobs -n esignet-mock kubectl get cronjobs -n esignet-mosipid1 kubectl get cronjobs -n esignet-mosipid2 kubectl get cronjobs -n esignet-sunbird +kubectl get cronjobs -n signup +``` + +For `esignet-standalone-2.0.0`: +```bash +kubectl get cronjobs -n esignet-go-mock +kubectl get cronjobs -n esignet-go-mosipid1 +kubectl get cronjobs -n esignet-go-mosipid2 +kubectl get cronjobs -n esignet-go-sunbird +kubectl get cronjobs -n signup-go ``` --- @@ -458,16 +520,19 @@ helm list -n keycloak kubectl get pods --all-namespaces | grep -v Running | grep -v Completed | grep -v Terminating ``` +> **Deployed `esignet-standalone-2.0.0`?** Swap in the `-go` namespaces: `esignet-go-mock`, `esignet-go-mosipid1`, +> `esignet-go-mosipid2`, `esignet-go-sunbird`. `keycloak` is shared, so `helm list -n keycloak` is unchanged. + **Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain): -| Service | URL | -|---|---| -| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | -| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | -| Keycloak | `https://iam.sandbox.xyz.net` | -| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | -| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | -| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | +| Service | esignet-standalone URL | esignet-standalone-2.0.0 URL | +|---|---|---| +| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | `https://esignet-go.sandbox.xyz.net` | +| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | `https://healthservices-go.sandbox.xyz.net` | +| Keycloak | `https://iam.sandbox.xyz.net` | *(shared — same URL)* | +| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | `https://esignet-go-mosipid1.sandbox.xyz.net` | +| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | `https://esignet-go-mosipid2.sandbox.xyz.net` | +| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | `https://esignet-go-sunbird.sandbox.xyz.net` | --- @@ -510,6 +575,15 @@ mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet. Replace `` with your eSignet standalone base domain (e.g. `sandbox.xyz.net`). +> **`esignet-standalone-2.0.0` note:** Since `MOSIPID1_DOMAIN_NAME`/`MOSIPID2_DOMAIN_NAME` are shared between both +> profiles (see [Section 0](#0-understanding-the-esignet-instances)), if you're running `esignet-mosipid1` (v1.7.1) +> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment, add **both** hostnames to +> `mosip.ida.allowed.domain.uris`: +> ```properties +> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1. +> ``` +> Otherwise, only add the hostname for whichever profile(s) you actually deployed. + Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c) After committing these changes, restart the `id-authentication` pods on the MOSIP platform so the config server picks up the new values: From 27269edae60d7f1efb69b78998a433c98eef5b23 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:10:52 +0530 Subject: [PATCH 026/127] Delete terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../infra/esgotest-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 9681f1e26..000000000 --- a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - server: https://172.31.66.49:6443 - name: esgotest -contexts: -- context: - cluster: esgotest - user: esgotest - name: esgotest -current-context: esgotest -kind: Config -preferences: {} -users: -- name: esgotest - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From b90214854ea5e8bfd34223426c53faf550cc18eb Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:10:59 +0530 Subject: [PATCH 027/127] Delete terraform/implementations/aws/infra/esgotest.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/esgotest.yaml | 1 - 1 file changed, 1 deletion(-) delete mode 120000 terraform/implementations/aws/infra/esgotest.yaml diff --git a/terraform/implementations/aws/infra/esgotest.yaml b/terraform/implementations/aws/infra/esgotest.yaml deleted file mode 120000 index 06f0a3f0c..000000000 --- a/terraform/implementations/aws/infra/esgotest.yaml +++ /dev/null @@ -1 +0,0 @@ -esgotest-CONTROL-PLANE-NODE-1.yaml \ No newline at end of file From 065ba34d5dd1dd442aedd16b2f80cbe421acdb13 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:11:29 +0530 Subject: [PATCH 028/127] Delete terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 720fc904a..000000000 --- a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://172.31.64.165:6443 - name: esqa -contexts: -- context: - cluster: esqa - user: esqa - name: esqa -current-context: esqa -kind: Config -preferences: {} -users: -- name: esqa - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From 515e4c679f8a4ae730724b6f2db0c93bff5c266d Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:11:38 +0530 Subject: [PATCH 029/127] Delete terraform/implementations/aws/infra/esqa.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/esqa.yaml | 1 - 1 file changed, 1 deletion(-) delete mode 120000 terraform/implementations/aws/infra/esqa.yaml diff --git a/terraform/implementations/aws/infra/esqa.yaml b/terraform/implementations/aws/infra/esqa.yaml deleted file mode 120000 index 1ea779d1d..000000000 --- a/terraform/implementations/aws/infra/esqa.yaml +++ /dev/null @@ -1 +0,0 @@ -esqa-CONTROL-PLANE-NODE-1.yaml \ No newline at end of file From e7fb9fbb73d1a971b1d1a26b3bf2c9c9d30f85a0 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:11:55 +0530 Subject: [PATCH 030/127] Delete terraform/implementations/aws/infra/rancher-override.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/rancher-override.tfvars | 2 -- 1 file changed, 2 deletions(-) delete mode 100644 terraform/implementations/aws/infra/rancher-override.tfvars diff --git a/terraform/implementations/aws/infra/rancher-override.tfvars b/terraform/implementations/aws/infra/rancher-override.tfvars deleted file mode 100644 index da1b2e2eb..000000000 --- a/terraform/implementations/aws/infra/rancher-override.tfvars +++ /dev/null @@ -1,2 +0,0 @@ -enable_rancher_import = true -rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/f25prw8zrsc959n2bk25mn79twtwmpq6hpxphf9xt97dhbm797r99n_c-stb2m.yaml\"" From 5c220d08beca6c4b0cd83081b7f3d4a862a80a80 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:12:05 +0530 Subject: [PATCH 031/127] Delete terraform/implementations/aws/infra/tf-plan.gpg Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/tf-plan.gpg | Bin 61233 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 terraform/implementations/aws/infra/tf-plan.gpg diff --git a/terraform/implementations/aws/infra/tf-plan.gpg b/terraform/implementations/aws/infra/tf-plan.gpg deleted file mode 100644 index 8eb2d1bda9db8ff8dbf17cf7b47be7e317ff6e13..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 61233 zcmV(hK={9m4Fm}T3Y5mE(Xi02U;ono008eC0gg2ms-J216BdF*7{6)2Ymf_>9!T7G z!1*E3uj+?%>*3#{mZ7eAy|#$EG;_$=@42-)lEqDwu7zquQFQ>DV&_bo>(-7(Zl!LQ zc}}IO2w+j9f)D@SBnKa=$OxPlHrd+u*K;e)%xPsen$r=*HUsq5D9)c+<;bk{VMhZV z9}kPw9&P)^plvae72W>k5;HN@9-DlG&Pt;~=Y>Pg2L8R-PrWZQYJ{g7sL!4`q}Yab zJ4gDgCLCt8b4V3A1Lf4N2r(r}sm!d#7ejjuu{`3FSDbUz zfHkQQCs~b!OoMU%0;fAM8W`_tK-_(lX)Kku-|*NBoccv*73%9J&OVF9$maKeiS8L< zpd!)ccpmRCR^lv}i2*wVG38S%C_iek&3BkapjR!FPj7pKvG%UVsjPnZDzp-Nalx7% zZL*K?pB$jkEz|Vr%Of%atj%y$(q;R6d8@LIm_?b=*CB!`tPY1k<;lhB5=Wqs*vm@G z$tKoN2*MFVOKZoB7^;@Z1GpgJNd;7ny}yMqHa%}XUxt1P9gA5M1pR!xTe>RH(k(@# z!5$Tq@|-7hS3PIPbtH$f8Ild7-vluMUuh=;2v5&A3&x1oU6xSYff8STVM}7amEUuv zY9gUyOEvl9sqpLTKfjT>*bGy>e^?8h)^Tvu*6T zH89wC1Vy0ApRfTnow42}x-@OewoH~vg?rrVXdTo>?w6S8?bLzg8~>DIy6X^O$e2N5 zazm;8RLCD6Bek z8*�B;TEGL>mL`v+~9mWyGgR4sdoTqkJJNy0XF~8@O4GVF&cOMcxa2%ZDI%I~O4_ z?-T760k^SHLq)FbuZIcVHrBhHksh43sJ639N7Jz%gh^dh<5@k@-S2vbI>y+>|9)iv z8AmuEhI>Ge#~WdE_$mK=UH@>MEz2><%cJ@v{(6y8(>gx0%~>D-jz8vvo8Y-=kkGVj zM!!64DhMaNx8M;rtyWtA1lh$VQ$5iTM`6^4D)v41+DM-;AAX@FW6^r0-lg7*;GQz zZk}>{(v9bqMk-X(ko<&Yv}%UPn3b$aduJZmGCxAyx0CADm6(PCI>RVqu-Ba7@z5#U zWIQ+prbs?4plsLl9C`I9H^w90$XN6v`xwpD~83Fx7WwH?oSuK5?uD(1&IDSb~tQ&gWrAkntpLCAS9-p1y zpsoL`zV?{ZCZ35CJTWFNwQS*e!RE%@%Tx=4GEaum8fiFr$9Z0sx)cZ)tn2<&`#4A! zc*+qlqX5YDbDn`Ek>Qj#WfrKlKr&9q-6PJbF(c!4P}V;`90~DIlGoZT9lMjfTY7{Wq&&p|<&Az{xk;dDyV*`U14Dz~qB}wL+8Q(yb zXOksum#*J`^s8fH?(P%<L-&oNl%g}aR>O@>W~L?V)xPMLBUIt$8Qr8aXI zj0sV49cr`3R*X+Tw3yEYGAGKf?CJwpfy|NEKJu0ES?ciMCWm}k*$$`NaI0&U)4`J+ zWyGnDs1#o)Z_Nr%(IeoWB|^}5KxaAVeapfIbuB}~2K;ptx1sRa&BX zIHdV54-TNzzUgYI9JvgxQQeK(p{VfhrF7F_SLCPyNKnvt;~=A6QI!$c2TntKs2sA% z>t-ioh(RJb?xw%_^RWU=<#Cp`o?{dqc=pw22|RCb02Gff%@M1ShImQEI!f5jrkvm*=%UtDi4)~6peIZV<9aUPY+E3BLP z1yjsWQLG;)|J3eMd~$x_%u!6d@2T%s!C5Rrr?%_F=tN=LJSwbA@*oR=HjBoo!76?$ zGz0ZzIK1$pZ9qJ+n?L;QqT~d#%g#3Yxe6bUc@(bhKP!WodlKiL#qn&gh~YnE^=8{0 z|79*W&vVtHbx&({8|>yF!vb|7b`UP<-?6@ZUAx+DsEn?w%eRZmV)J~+*tXN_g4jYi z;6h{xys%>iTecW8uU^bW^rcW&8q;sUkC(d&X_Bhju>Hqvig4>hidD&B>W?@xcQj{d*-o)75S2d9iWS;YC_H# zVNGee^H7-n+!(y)ACN(~vDBP~HI9K7#e%81`NP-&q~bGYw8Isgpj;Qc=}s_XxEA^2+|e^ba$A z7Dzl3#CqhD>Nw`{*a`+3M`I?=hZsD}JZ3#a;b^8PK@t{q?!B%smN>Q1xkkZ2M7^=s zqj0!bnf|KyQ-IV*c}2#JWac`|qu$t!_+r)8O&u6|07%K>7m=s2CDr8}o@&E0Kq9dp zlgZgbs?!8?3ZnIMbEWAi}INDJUWk(lQ{B%maU1_dviwcr*3D1vXH5Jy-dspvUoP^d<=8c@R2d%aEue zOpMdF8Z2FCT-W8lsZ4*b{^3dJ7e}5JA|_2dD$@eQRrv!aSok;85Im1YTLkL4O%p%ZV@P#*M5!CY;mH zK>(Uj)9rLN%*YHr{HhyW*CefcQuf$WuMbfqE_PvDdcS?memVF4tLx=B{vXys0{Ul( zX&8pWzs_{3<156*o@R(0|8OwdBKs!;HKfM~j0fSvwq*290G)QPFO6n0+DOyY&168w zkLdbegZAK-vS~R4?%PMtolXq9T01hUXc7Ps4PY*z3PlwU2{%DE;`pJmf&*aK2$(eu zRwm#ph$_LOo!VV(80KGRGU+yZNfwIbGUSoR>cc#;{6j%dOVvY(}w2mpZL)+an(Mh#LKh=z;XuSds=v4It-I3*U5-Iut<|EYOhp;vl_R>=48RE0Z-u+&d_-31yzj760v)Z@dg476RY@x zs$4l6uLSGRFSFZIM4+37+hBZZ0k)?aF9%UU#tJb=yDC3-skR+t}%E*BPI zLGDq~o1xa90Bw^{rn{@a^mxm@RLFtgaoZd3M2H(DX3Eq@f;x19WW4~3EKNQ z)X{^WE-tC{uSv^gr|(Ra(H%W`hS929i7q94vybD!^Rk!f=%$+ki|TG`;4Bc=dr z0wZpwy$wJkQwc3$3Xmx?G@AG3xFVq4Jdh}!iT8qj3X+(-m{oiswr>p^D9KU_=WfO2 z6RXLycx6t+a{UrGw66M#Xer!0Y%`C|K6Ur)^VorW@G<8~_vP~TB!bAlbM3O5ytoe( z-CrniW0v~g-=ucDCsbm7%4o|PRw*Bx4z)zJ5BU)@Z13)Jy?$E^eWL1=gJtNVZ-JF8 z$)psxzQ^a$JUH8H6)rMqZfxy{2hsv>#fX*QXJ3uNmcdqZZiF4%SNggr+v?jwM;QI3 z+1b@y&4%Fxz_p4Y*L%uW43Gl=#jc*4n>bdKD6AvPYCXo|N)G)_b}uABo?08$S`DSE z*PhY`1Wf83FQ1SevSh`g>BcGp^F!s%dy7^aYE3405v9azQYvJULKnaJF(-Gm8Fy}w zV}*Wt1;GxF(5h3eS-?hgDwF<`#X%?%wAxq4-r+#OkJWxl6Z3!)IC*UN{GM!s&7ero5$|LEnO9~JcE#rYVRV8UaV;7gemcdgyLGjI zwOF&p;qz!DDjXZe6%p2UZgun|UL5Rfdl7b;z97ok;nrFAv)d;NZ{9mrsMO-XD7wF} z`7mGt`>ctUuE;*&dWQLN!a-MI%Q4YeSIQZtOh1 z)Jf}-(okNxi1U_xAw$*v(2>j_RRWj_YI-y6d_bgh#9EJM zjg8KgWW{Q8ix;L;8wxUNIzhKEVU=c1zk&hmZ{qhTJpiOuh-*D&+d+OBaSgt}I;#kY zB;2ct1cpg8Wq^McQ@A1zj+ULp)KlyFIK09rZ0_9>G&6_rFJ2N+5XjbsCZH z>ZEY}#$y*FbXIe3CiO{}>js2C{h&JSmRVZ8j1Dn(j_OJ6e!oQ7O>_0KcO9S?*>@Ne zTkEagls@NMIxYC&6D!t7mPl%Xss7+~YfTYWOhc_{;g8W{((Q`gyL?s+@S80bx4z(+H!NG76 zxz#3^mo$%hQLFqQ*|S84vX-&vk!5_q3V)L~-7y1jW{?)Kra2 zl~(c_iNy==sY$<|I2K8_N09){C&In(1`n>dd7N#U5COt$NE)A3#H$pI>qgTt;Ngua z_9_WI+Mlf2tQ5R11D0B4@~t`C^N}CZPP|#eg@zz0b#D08rg;MKie^gj{{p-ydZ;)- zQOY>9Ief()sIwa zbP(Snzx}KXoy1p6cW?`3p^MCEjpS7GrGx=LtqoW>wtEz6Vr`q{u`vNcL+wS=CbUV5 z++1FWEMcc&5F6i-@l~0UAsLuUqt1h;Vo@*vcIjG@{dIB;nRuAkuuAK~CNBV(8R=|9 z;&{S4DU%J6M{%`Dpa^3|@4D=r467*IeGiv_V7YlsuKiR@prOGrJ}**=bwv;)0Vlv~ zHsC!#y&w&Gwu@#Sbyxs5u{VoT!};Ki8bzLSnChKo{S_R;bklJlR}{^}7Po`h1`g{0 zgprX05Mbv@vBRHv-Y|l>LnDd+0RupA3*71l7q<_8q}RYFM<{_J3l<-XGDFyG(?({b zt zex@Pj%7livq5NL*bXEWgaF`Om`*i z-S(eYL7yznAkSyJD5+?ALfNGUWAul!z1>}@tM7j$E9_MhU8HoJA?Cqr?F*XSrfzRS zQ4Z0c^xORz@?RkF3tM1vml+9|EB=tC{I_o5w)j9dD8OjUF^-t9&TrGTyPisViH8)b z9U?!-9L_F2V2n3kH{~7O00C2D%gpp?_F8wAq#rWiYnKUf12-tvq9QIqd?`UOJg#c;YS7ZVzY=5*2GVF#5MYQ2=3_M4&?}g<-B?0*@Kmsn?{ox~Me=7Dk)zE? zuXE;|-A56;IeZ6O)QoW*3(afGBZhghYdlxk1@)r{E)D~kcFj>lAi>RM>&RuLYRiK@ z5r{XZW&D5=t1SbTLvM+JAg>N$09R(V6AeG}O;hb8@h#XJYyF3A2L7)e(*G`W(zB9u zec`mYdJELoK_~pqKi_t?>;_5p)ffke(Mi~|Z%csAk?T7ckw=q}^$Z>ipr_L!qoXAP z2W1X;E5jn{*4ZN%2N44+-*)FkHf=F7(sp%BK%tcLBSIOhv9|r0! z?yY}dpNvP_G$qQdRKftSuEyS1;fEU?COgEDX6N-8YL8$o<$m|-)N`o;-y+n-qGS;% zJSBA;cO$F{dNb0`Db&u|@PvI2@@~|>lPV5>5fh|vD$PDe=85d51peAj`d{{A9^m!r zbNqV<9X&hPeA{xp`cu&aPZuFDMxg(JLy!A7AdQ8zp*n;2Bl-Gp!{Zb_owAV^bG78?xZne6cry_JGlT1ZcwzjKNB=62)C%L^XxLiPI@H(O^(X~3da2!u9`?qY{q$Qq0iCM6myy{#3ucNX$M}#$apK;J$ z5%3vveRkCRP_e`5sce9_gq|!+=X5nW<=-r8pLheK!g_A80w1CbnIHP^W=09XWNDWb zWAb>BG}NI@?ahBFS#!3ye_zv&KSGx{bb-KR2A07aS{6(psySK?n8(VFN?chhsg_Ul zG_><8A#d7?lYDhz?r*lDtfhoY(KBMB6j{!o-D(!H3dr0OuIl^_7SY(~WbfKMU_WZHjgP`1W=9haBwQ zkBOw>v}L>I|mejgh&WNC1$VO3(Dd}B41Gf+*NVRkCntkLpgeA|_h2pQu0 zyrt%?_P39^O9*nU9kx=yeL(n`cKT!oOOV^Pyf=Y?cbF?Ch{>Qrev?Yep&&vOdw8vj zyK1Npz#(evqKQ2r`U1f=glfJ%+eHLb^CU(qOfREnwr?Abgst0jT#d``K9aNF2VZW?I?zY%m|i zhL|=9DLAKS5M}XuV7o6%iyYB`RW7_Hu7=8Vyu}0Dz$1uS75J+zKbGl**Kol>E#HuC zef3Qp7q_c@GkhYUx&F~KsP#-Qx3sMwUJo<}t+VuLH8OfjfL!!Mvm9r4jR2qCQOdgw z9W2gI^GS;fRg#YHx@>R8cXnm1EJAPb8;o?RwcAR9+)8?`_lt9ALmV}?G(05IBpdg$ zU~FXmtFu6uIj6sZ=A(OD^_RH;NxS~F=eo_L;{tUxg7r*y%1=@- zl}oQlZei5g2NNHcoH|zHmk%-pt~x{dbOGC{Z?+}0pb?giq2GK}6ZA-(9k*)Tc|@e%@5u8{lO zJ=Oz~9O!wQQ%%n7N`W=nk^8A0zkx!#;U1rj`Nc>{xlnzhg&LX?af)i_0pY%Kc@ai< zx}kq}G3rEbe86vqmt#FS8#u(kp>$B+48~?}Z^PXq+<3sy?A{BU8H+27*0dw`mrKw# z51ACpIC3)M&WWL*l1ggC-Hf2Zd64L-J!uzLx$^ssWh?>JH_k$QYg8~BsEROiK1Ql4 zVKBN+jS5|cRQvDV0B56{hHTI)7xp*Mn+B4Jh;YE0uFwWfs4J@6*bhvwh9uw&d|VOV z;jb-zz#t2ZVH)kH)Huq1u@h_{2)Sl%QQQaL;vGwjE$}w1xaS+|;>TUv42YB!((wJp zq3mQ`W}6KBSS|~a_d7ceK$}=jfAs`huthYgu_ZEek1?$woa;hF_K^wVRW7oAzYR}- z3ZEcVh*m}qpX||^>(cE8?dqBN~{*zc7AS?0D$u*CM0|Dg( z$!%f^-I}84XCh_Qbr>2Y3(@hCdR2&66|)bn+dL8HfyP)mz8mdz?#*Lv%*PUHeBJ9= zgIi7)vU~p1q`>OtiO;%xr_00u+Islxs z37;^N!tq9o)JOO178)=RPFZTZ`U4K!VBh7WiR3NL#5Pwh#HGh1bXt>=GS3y@QV4?p z*kk7R5H7OTWx<<1wEA`;-ZCMf#8Di^Js$Du?yK>-aBlA`82L6ML!2GDXVO%U)jc9| z&0ca%7n1K6+%wY}_spn-%S2f>(ra~fB9t>z3>)j5A6KjV?5-qbUA6LoSYSn^^@eIgS{%bI9~NfVY;zVpXR0 zu9ZScp6$;EYo;rL0V|KXTuF*?z<&PkUhp)}DIe6sR+Wl9vQAlndp)dEQYZI*e~r+& zvo~opNZ=1vUU8<*Q5&N#j1mhwlsGY`U@|?4$BJW`e*yVbBSk6ZlfHQyTXpgT1mq%9 z_Z6o!D&jXQAs1_lY@8@nNV%dpi>Y~K>`41x@z7VjQeG5MDMQpO8|dpt#;^`XQRAySlv$2)A$f=Fi-1b;n6aTMK$UHVZ|#s zTH7xH*%NvD%^_l^eds68mnJon>G%ISaTQ%taC;3C3mRVVx8<7yQVAJPqev5^99_r zS?evk?1p%7n(jM=d+=&L_;PXQIWh~x9yxjeM2)Qd?tCV5qKUj0xU%v!Nd~!a%cZ}$HjXOIZPf^99^)~$`NH!#+;Wx*zoA}T zXqK&a{kdM;Co3J(Y~d#NR|$H7?Wt=H7%OOyA?y?ko-ziC>}cFSci|Ak!)3L#q@nDj z`;Z4cb494DtOTKAzHZ?EaPp|V<(h1>jHkf+AE?$>bEwaT>}#*xo6{9q0zjDQ;1~ku zsny`LMfiGlE!y8_V-gI$ixA2??>|ho*9Mw2x|3Gjs(6h0)*%HRw2~B7N99`$uqs+HoMkf)HTuh{|GOb-s7!tsyhz$G zOJNS$m*?e#Q$|rgw2Qh{F{IR*3B3jDBZWLLFvTWF5QcP6N9Nf~_QkfRRcqkhO)x1k zZSpf-j1F3+v*Eb~kK_HKvNlDzTae#$lRRnC(yd^BQ6XNJB`c*RlKc7bm0^v{Zr5+NFz^GN1D)aQXDw1k{U6`xMY z`o$bQ#d@>AfQtEJ#;QDh(1&bMf&%0;aV|Wwkl%EjA zQHa^|ughnUtWIirB;VDzuN*9wMyaS)(7CLGx`+jf2h?#wvc}=+*O1o7nh0SrwcgRRN63dF5U@OzHh-hJB`~QVm956E+ z+m7Dlw=Nt}FPB(I%nG^~Z2Cv6V|z^D>|*ab_E0^KS9BPzrGLycJkb6)C7I&mcQgYO zLk`E%gG=Y0%pa(8dBnHA#6Q=~b(=m|^N;o%r79%kXC>xx*rs+3-oNe6V(6|ePDvkR zn5v>{+qDxq+eO5k*ISFGp4y3L6P}36gAafWS4WSU2L`FEs_G5+C#g=I{u~KljP+GJ zH1>cjJbMe2-v*KN2bOOPdm6N^q;%ULlm`D7Bn#dVMZ(W&F;Oi)vTY3n)re3p8N0^$ z#y@X#2m=}Hz6+|vZdYKM@I=VJ9Ydka?^HM0H=>ncW!xX6z>H1fE_B{`F`OU)yLn|N z&p0A_LdnikD&3(ER#LR%X#tj2TL-;g$Q8`re7dG zt(1_EzhczyMd7Csr`=nnw9UN}1G#1Esn#Au#sA?NI~Twa%o`Ob>`ADqi=eUf-$}rl6(@J@*51)ChJwb z2OV0+t5eV6Ob}IUz8q$Mjst;M+K%<|?tyJGf)4k8TJ&I)YKLh>R`G0bpVS`Vs}@XB zTb$|M-f21Tnn79OZ=Oh`sc11}>a4mX;XzQx7!kig)*tOOJE0q#;qD7A-gW~X6<^V~ z^*(tOkkUKiYNt@l9EwlIX1_f8&+6;Wa>~$a=0+M3qE47tZ^OcdlL>N=gakw62rtdZ zdX?;tYMH+@5NEnAh_Gd(L-KH(f(I^o>VX{^hAwPzZ(j%(vef;1miq}Vx64<)%PBx7 zh=@Wy9v6^%DXG;}|6{&$l?T#7*k!+nel|UqmGzu`f!gO=G3Z6d%tN4Mu0dV(s_fV< zbA#)@-y+A#*6mAqOWcH#rQsZ+*FaIcU$#`ot^5 zQM|%ivTQ2TZ<$c0{3k$U;Db{6o8&^(1L(jJAjertX~d|Th7F)1)i{!IEBk`yGDw(o zP6095TczY>>{b!E>bI`fk8u#nXOT(MlFxrwuk*rA& z%QXtOjR&Ywpo1<_w-PV+QFmtUdL0Vf%8Z`D%MPNg>xC`*&y$EUb&NZ?R(n4H7U(DZ-F^QitA=#l-iqu)4E(u|8(b zC_{yXuQ!5zevbowCdA85enuvNl2Re0rY5K{%-wiDbxMxKfA)FS{P>W(%P>NQa~dw1x4$n^G8d^GwPj zV^#zG+GZ5*T{zK1Zf>PY6Y`|}YbYL7t4Hkyonw_#4 z-+Og_xj7IUv|(&IhG%6VrZ-(D{J|5fyRBUc!UlT`=y<|wdJ~e;UCMVJlFpQX)&|GH zfbTT#MRSAk|LMdZu08s+1kg>M@_yU?6qoviaG{~}+B8WN#Q7 z#4{GOG@It|G4-htqcV+7laDy~Sm)xqQP0B-nKmzX{7ugr(bs=oBEqAYVz5=ga-t=4ptzuOtU?9E z-Wmp(L z2NLFjQ^HLKV-{lK6cbH1k+r^b9tACF_9Y+;;ehx~REPndb+wr7Ty;amXy(V^QqLF~ z*e-7Gx*K&OPTju)ln=dOp=Sr(w>litl)S$j9cKWU!VoXpeG_n3&*0HL2mkk7zbD;z1CK#09%Np6O{b%Ysw2vJOGreYg>&sraZ+Qm;;q zjB-w!0UnV#9WsDK)B3up6>O=_La$ozc+?{tUN@MCY@Vry02v7w}I-kuJ z);O|4_|zUYp6eC!AW;Fr{y(bYnu4A92~g74r5kqm*!Cq1pM`qqq>_Br2McSYEtX#+oIIS%&!_~sx;w?&X2Dzk|M;7G&BqJR~dYuQq} zr}9he5B?;u4jC_8c^j$ufUPT0Yv1N#=d%8AlohHKc{qMyu)>~vGQw{cry;Vq`UnP0 zA#~vu{yxePzzV)aiJ}s2CE)a*dm2xcN$q05aw{@t;zpHTj0$7K74G1djJZ1TStYdR ze z+$Pmmh<9WSd43R7%aI$`Ev2Exv0IKR9eOz;s-oo=)jh&%j#$!_;ZB!pH6n=558`Fj zWA^F9KT`<7M>PSoNmi~_jl6xnaq#*ktS*0us~6=>l>qibgjdtQ_rQo0O)M+l9{8iO z>e~nTcG>vOzjEIC8hi#0H$4f zSO0JwLa@n2`j(py*p4P{w8Vkt8+lAgDLPL7W)>oH8~Vvnxk z4_j6RiRTp#Ok6x-)NGQ^tVcUCx`%ZiocXGoPK-Nk)t+KXIuNd~9h1(VUD|ezDaQuA zi6$oHtS^{sI(e(Ulc4z^ctEr?P)B)QTf{DR>JehojLRW`kw&{~s6)n>E$&c4$Ah6x z1MgBL@?AT8h0x74zRUMFuXKnKnzxvp^k=%Y`BqID?uY``J|s|_P4E0!IO7R9bd4={ z`PaWHGIP_4jnekA!9(8Sp$calD;j8Y>`nxHJ zm<8qkmxfJSpAuvc8Biu*2oM0?uMLwU?Z?Q3Nb9qN563B_Ku?6)c~~O-hyCc41E3cW2luV26SMm0-2@mIV zO7jc_8Z1P#*8CKNYh$Rv7JRbtBE6gI zNy)Pj{PL>UH)gg$GRS<|sGb}lh7IeE0Qs+UDnV3uKmM>qtOF*Iu12aD_`!8~>F99` z+N}*cxJr*#@jubB%v;^(g81)%5?MVagR|+iS~rzzB)hB;9q-2mo9gJWSHZxlyyc4&~@yGxKvqWIUrdip-b%vboA`&FRx ze&R6R5KceXffyg{Qpzzv329T>dIP(WbZsbrZ=-a7Owy%=vPHZ)OxK1ZdyD649AS9L z4QnxoOI{qp5+7B_b~GmQFY;M&D`GT$1L3UXUU~AV0I4MbiK@+Z*)ZpHk-)4R;6GF7 z3qVOTTN%8hkq3mM3s?Z)>jHXa#68>}sL>9do{$`bJ=ldnyquVK;^Ov9bijl3;Uy7G-P?Ainvs_+JF*YlP#fLQ{a0qK8@2h z#@|YvsiP7{SqG7uo%v!g7zO(_XVC7^v+9n=aJ?Nws=}#i?YC1u5N)vF>VkFkp|%-( zLc-)7K~&E7)M-ZL?l6XvI^$(1o=HH5Xlk7Tc*UKAc?pfSa$GSmU+vJ0+%MH@vP$4-Xw6#@#& z0F4$Di5L&53!B1Mp2sMSKl{dsD-IJIcv*2g1@x@wfsB=97r(=xSG8?TYBAXrOOZEc zb^)H~A_7u0eY>OO;){Y#Z7xWthLpHyQ!-?JppQC_d)11{XQ?lH!S?1dhszO)oCu#X zZ_}W%AH4*o?F`x+QPT}8KYrB#TN|ckh(igvM=F?l!1h*1j@Max3y`ip z$O7XN6tKG~1NrsXh$|>b8{nFn{p2wlr8Zx4XvTc?+g@ZFmHtzh6ei9E)-r3dhtrhF zcP5u>kU2U{g08~{Ojl*y#i`GnE1VADXCSPm-3&Zi;OL~vd>VSu9(EX9@XaV>_P_4f z&S+1pI@^cG_m)&vm#HyOd@&6_zAn_WM+gB;D;_@jtN5?E;4fxJ$-T53qfYqQVpIPG zF8k>ME0Qnw6$(?lzT%UmI;-j|S+W(&p4d5agHUR&=oRU>U+U51HY^DYQZLI|pIU+( zc4NrS%e-U^sHdZ7?k61VIqb#Y;y>BOgwxfDA-Gyn>`CiAT|AzQnvNky;w@9ok7H>D z6fSz_ToxiF;$@V~ChinCpRS#t)ndQ<{Hol5fNGS_#yEL+5G699sX|fsVLAUMW(7)W zM$`Tyr;~VhQpU}n8o%dq714TkXw-YRQE)il!gba!%uZOtjixxVZ?5DxiMQEk2YX^K z@xK{&0%J2W3+E2YXD`v6GWML- z-N?NA`cxV>n=iNka~GbD#%IF(5``Uc{=(R~jm?oS;`!VIo*QbTGe9c*^$adtn!B(U zV=%X(fYy;7BubMEG3xg=uc(PNN(^*qohaCsRY%xuJ#T>@lly`Gu zSxbT=g%RO0pjXh%6x$gJQ)i+7yn+sJS5e(|Rc+IK77eUT+Pt5OKWg+yl!R8wcaJW~ zJ@3H3f*_gAc|is4+LeD-`}4HByD{0(f8(smLE}Fje}R4}V10pW=X3@YvnBal9g+VA z!c$#?QD&7jl*qUu@)7ta~rn<|_b-$)R%Q^03YeM&nb4D|x+IP#_iSgJ;>&i_&@ zAM8Z?of^9D2#|Wj;HJ&&SjzMjBdwG^95R>;zJ|h9R~XgJL}%e_=q^Z`|96JKVd z%T0fsJdFl0L88O0wr(BNHe{gnZx9m>!H}fT3ll9kFg-Ba)=kkL;fafz%I7^SbiSJb z<}x9WtFKYAZ_1Cvtej02E_&lZ9Q2rJfDoh12zY9)1WbFlVF)wQ4nx(P##7+ub1y;3 z%E}WmaGV2DiKJ0GB=Y}%lur-Z0B|=26|wl?(vK=a$L_A71W!mLjY@9g?*G|{;wp_% z_^*ObX!$6H$_QLy!19OrW8tDRicn*u3==V-QDdU4H0tm_1?dnVRU{y&D!%cmM?xn< znEV4OJ_SwRr|HlpFyXt@Af+NszrD2?Y0dB=mu1co@&XP+(}P+(4hXNEHrB+->%iad zp2qwV$*y5XYbGvrXg2U1lT_@H5MsOgy<^&}pZger+!U}zyZ}4=b{b$9BO`oKcFTabm`Tu^Cb2J zu7gGo@K_Sx0?q&l6XS^IO%280rq6%t9UK;q+52c{Jt8ib z%JRyO#K zd_1&9GrEg7#JEU`a3UMN*t7NMfUszXXV*R%NIpI z!a=xo|K zE%0@6flFnV#P(W1dC^o-xEsCif;U$-@)>O!3aT_P6$tZpo;l#5nTf*1kaYwX&cx(?;Z6ct+!Wl(D~}xb zmg#qie0d~{^pxx|DX4#D0$77_vIPR%uyA@w7g&Qay8+*sQ+tCTIWx&3Uc;RE-iklJ z5ER5J8o`A0VlJ@v624M_WUjwMpB9CZLTQP`O9LtpuqjJe^>&|=KpE;PW&4Eh+J&v_ zC34JYxxdrOoeg@fCDkO=0>t6HyPBcN;s>;f*~omtep!^t*Y+U!)!mOf zC15|LiajJ)X$Cj_QvVx&6%ENaj6bPrp0U?4HME)|!nQs@$UqTZ4|Kny+(;1seHdRlh8W(zWojYXtty5m)WD=YP=p!#Z1#7>4 zX}l>3R{>7jG$MVP4_q_J;aU%#E}<05p$aL&7rVyzz_#(^);-2HZ!$r!b-W2FGV+qCcX0Flcixc8 z$c+1=3rEXDJb+WHJg5dvWCBsK15r{pfq&@tA^b7SwESg6K>d}>-0qv7E>iKPsRg{F zD(Zt2(x9@VcyWH4wT0_9&CL%IMzrP=L&TL;<*x+osu%o?#hy$tO1PHT>ImS9p<1U2 zPQ<{62uH>*pyOAL*jTA()pM3l9y078NyWKfY+9t_#`YE{^)bbM&kmYdp~fh?^=<~a zLxx`~?6!@iHxU3=+X9{Ovb;zwX_cce zy-%;YB^$RKt{FBp^+)0p0&EJ!A((Cw^dyU69)EAY<1pbU;O20APc*UBp4OH)<^!~s zlsAd=7SEi&oJly(Db}AEwotK|UFTG#58;zsf(I)G4@=Rlx)Ro(*>y_1K+~a}O{>Dw zDL;V>yJ)R?B_5w;+|fSQ9da#q>vS`Y_X;%LzrGxhBB($rFmAYFKIUoJKKf84R1zS6 zI)F`c$VXtW91HxqJDwQAz*#J@{mWZWSo-%nP>=lD9M^SO%M+Y+a2vM-kSJyDB?t2h z<0UBPkEqplSSIG0?;`g2_ILneh?Inij_1l+?t3F{;lyB4ceakT`VFbtmaDYmS^{>< zE9aW$u~P9ekL^4^Jve;*ir`jW_Gg!VQtH80X|m>+ zIlr}vB0i_VhTtY@H7GKT7$Y@tl{=J1k#4bzPg-cl^b@!E0V7E9es6v>eZFxnVWTKp z=Q-&o)A#RXHna`0sy?yDItuds9)?BTB5>q+ z$=$k#*STly3CjrNVi2SPWiZ-%hZEDYjclpI@$)C-d2 zka^?M*9_kpf#S84D9Yn&4Y10RJ@6xg?~iIjjTfL$R9D42ASwByL~BBqHK-&%=ky7< z`WeV{RPSU9pp{5boddy0Q+Agj;x|0G84IZVDf1yN8MKz?p0kV<Nbvm-$Z*hwe-+va6Pe|}yP3WYnsZ|WW)sCjA@ zz$qVIZpWw^WpP-4plPr#$i3xO(IK&J{GKZ9x`&C&f?S}yAc%Q4NO;ImB6;gaeg|kl z3|LN@47mz5wu)K}V>`ve#<=pFT73>ZHxSW}Pc1xbqI=2FKWJ2cF0Tl2Nfs6#>fR#) z*IvWDR}Z&9tE4-%^wJB8z0|Df?LvrM<7gEXXY7NtrDw=xX;xWejQ#rpO&Gvyr?;e^ z=njvXpl4l%)1_;hY|4C{4avV4I&KQWQK41|p(D=@p z>Z0v8^$b@fg9F#~7DMjm1>IH&tu;rF8pEN=nqNLLkzjD4-n-^2WZrL(W%;A3pWD79 z2i`;Cac+AoHbgLjLpU!(7nf@39KP%zk>FQWS9u&B3KRzXw;D&~d5v~2IIt~>`+VG& z7fTFqnc}V5Hg~nQCfEaK^HZGT7OsSoi3zr6g0YCL*cQq(-qB(i zOk`fD251dUfdFH(iY`1L@Xw=)Ek*Vlc##@Q#!$+?>#o+DC>B3bMrqDyI+bha zkPsfbUJW3of~9F9dHrxH^p%S9g$%eYXsC`-*2)jMR^_&Bg`zi`NTUmVMh%Zoxwk5m z(r)w24NAP#LlIPvK@ifJNQ6AOvl`l^A~=oO4#y`d{SRgmBuJchVc<@4o8!kfwUlYB z%b65S3_CoyEBM9n*VuneXRui3hhG(hz|TUil?c4m!^iS- zBZv8SZGa8N>ZNHE+*G^ZU()mY&Z*kR>}b|`;etOSC-SJF?so^(cP>!Z=(l=Yb-}#C z7-OmqGG_J5_Zu5)p*r+Xr6cM3`pvkh&qDmLOXP+>taY_w0$WV(gxgp{Jw#w?(+Mq- zPdUBWp|QNnX#wl1je%n8SF9mDdUUpitI>tvz0VA-4r}msq!=7wC$ptOJx4%h&Z+uH ztTfdpGuBMUwD))V?CeA>0$43tTOZBQroj~D4%o_m<3j{p9N!j}h}&x{d+@zusOjjx z=McU$ApYoRSd||yjr0(2(JWW#8c<}EX-w2@_O=Gf(K^>ct5xzaUVoee5eXV8oK$$q z!W3H|FXe7((iZ6Yp5F4u1fM1Cz?1;oaLv0VvTfZ!2m-!COFKb)U=3pTAxrbYUhQgz z7nBA!>df2Q;;!T*nCqS2Qc&DQ)7}W%B9=#xZ@JydTI$uC55GG$hdi{nj}7adZR+{C zdWE7ou30egu<)aw278L3S{>lGclrt#Q4aRXndZhhqU}M^0odiW8|z>~%T^Oin_gb` zFwRTMBC|uK8|7%d%SD14s!sJJBN0a(vPHZ+l z&A^>4WQCZ!efdEk$7{7WZK$1TVzC2PMwt1$Y#@ zjMl9D%sb>z(ZJnj-5d-!Zzc56_&QLK-R=JOGbJE-Sb zckh}ytPnni>hv_a?m=W#INPYJn;y_dBa=o#XPKP~(NBE<|2sSKcCz)-=WSOlSb;?VI)579kh zGlrfvd_&occTcKv6HpvB?>3dL6N7-@jw9kfHpD-yT~cSo>D(DVM`=AFr}LfmT%>=A z`<4(DuQGMmMC_uHy3*+rVc{C5C867709$(pD`z@NXtu04^Loj&y5zw?4+SS~=84{9 zm){?irvKioyf7GO_A6xSJ-pu;(-Sn2bKGYT?{hz^!E^V;yme+>1a)*nm8Gjj;UYKc zip$=_d_i4L+^wEbc;;X>>}*o1ab3(eB15P9;wl{fdqjZu(yAYcsr~`Tt-ezfeEw*s zA>p*86;fC#pL+D8fK%VgK!`;O#G~{ay9Nweuce@-^G^?28atB#9Y~lFv|@$OGhHqG z%}Qek`sMzi)IGbU*PG{aT4T(7+=V2R5DPrMnOP&z61`X+-Uw<~jv@#;D`*SW4ZULy zVx*??2qK-;upT8yVk4Y8)WRL?7z9)zV3i#Tc}(8#Ck8}_8cJ-pW*kjy5XvCz#})+; z)y9I)utA>W-f8w@C4#rNQqB%@IB8oBj$YZXi>o28kQ!xYREuEDV8b1v!dh(Izew?} z@*&6n!Onxue~*H*P=%6l*=DW93qlX(XQs|mD5qHevBEPs6CCJj2(jp{8n>|Z^9jFx z6c9q+3e5$xJmFz}Wkx8yqLS2*47LD$93Pg)w~*#c_jd#-PH!osy<8KPfS(VM?#DbbxX7g>IBRmy zXHf*!`(ObU5q`}G4Gce%loF8!kL`em2>$aa`WFwc7?14vwv6^EV$0BWr`Q$E38j^f zbda>d+nK+FgzOd){&}RL-mFKVnxQr za(<5)llqg~)_N^`klTSTj>7p$eNnerXIk6s=QF3%Lf%{f@gzj^gIiMQ-V_V7bgoN+ zhK31Ja6N_t(+>%QL-enJr)L>1FfjuB7B`%f8&LL zmp^xpA6tL~mJ?VWyQXQP?@h}})B2vq@_GOu7L^+~NV;zqPbMyd>g-DfrCtGmJ%=w6 zs{bSsOp_vX+FOXa#g>hq1@#^<=eyD_+~AA(r!dEcZv}Y60x_Fgm1aQTi6X}RY+-F8 zdjo~^8_75vC@lOp{`?a~=D`y)oV{xqb6|heH!T(9)~H8uC}s-3t;L;(&rRDX`k3&YYS4{%46?5#Lx52rqTix+YQu~5rlgf!O`oeD20y18iRWu z3?A$a)RrmPQHSYPL0UxNBc{2}mR0@djekmo85Wqt77@hP&N+GFmZ+xG&L)P2f^Jl@ z)~G;eZuXl(Vm);x70)PsF{n$qsCzr%GgjNC({%6aW9r_Vj*%PbEwt@L6`>-!j3pHd zXm?dBGq(CKMKJV*(MQSE-%?XItj;rp{xiDW1~iKEjaYx%XJJ#~+R9rNBU{kRYZtW5 zeXhRcxhlNa5krFHv&tywWDV@Qx;tH4P-z&meUESMUF=c;Cz4=3NTkfXs6YGm(j)mv zW*C^QC--gxyAA{rX$g5bcQwG155OCXCbqzhD}8>iBLHpf@da0z`utIQ2x|+8!@tV9 zH={pbXb}4X1c?frG?3Z=8~xuM-`pX`$v8NCaNw#r;xB}rQzW&8#&(T~Bd)}aJ@x3` zxby-E(elUL1~C5DC>#a0L1r)?5IG3LTe=GhV@II`pAOIhC)+qWA}7G|>{@CV^a(IP zhl;ycmwT?Mz@GxltAf#3|@xNRUpaY5J zLLK{I^KM2;(R8$nglNyhTQZ}Eff@yQ##*8p4*7{`0QE$D=*+oYLe?A7S7?A4m2Kcn zw$K^LV+=n5Un`8T=L{{@Une)TN zcLWQvVgJrj-?!~>m9lnj>Sg@fLQ&12#MF3UCYfq>HUpPwm`y9i`xgqppjbz#(3Vi%!3hpIAl_X$6i3#o5`KxbC;;eJls zZWwy=-)NsX0|o|RZ?-MTDv$cYXENHpE!deB|91zCPiDOA=Kx3Ik_SH(P3Jdma~mOj@1U;byah2VQEamsjr@*snAh1xmiY|%a)_tX7>($WV?PF~ zg(FXEp1%&mj`-NP;Gt3e_#PQB{9a|;e#fRHT!PtE0rP|Wq>x77MYip|K}DrxwJAV! zgOr9Ujj}KiXKSV(%>VVoT_GdYZ|NPZ1t|@S!QuDFY?RE=2@Tpn97)1OST|Y92`Bxa z=P?&iN09EDGM=lS!+1@T79x!Q52c@nl<<>73_J(rN(@+&D7((^D-)c!U20KcF)Oh1by5nlOu^8HOWGuJw z!Rv;fy~_CFO4AN}^ zhSDL|{OMfwJf4|iLG0`%Y5R2WxoIOUR9s5Cj73CvVSOBZ64o3UalNCc1Sr|SRJ)BObj-GIp)D8F8i#%`IY zdLMe@Q(Rzv8+(8#8$6`YiDjs5Yrm|aOK{0(^AqW<^!V~3Pvm3-Z0(SRD=YS9y?g-F z&626>j>6zgc$EnMtaXD1jxq2Ws0*9OSa;+Dicm%~1yd*OZ&%Z2t*n9xqRXLGS!go6 zr}eE!?I1@ef9)ig5f)(L1y5p@+DIf=e&79D28(Z&9$;*B#mRrR_Uw?K@#gv^$jxqI zgrpktJ#`VQg6loNi#u>)k;W-s8D$M`O*E9f$Xev!tWi1&+oI68sU^i&^<-nDq(7SI znh!~jQk9_bgH&-#la(!nPnHmc``jk8J1zPL-Zr+~SNC^iJ5^d+Zo*k^?AL*&Vmgsf zJu5S6J8~ce=7Zl@m__5qU2433$dK&GrdwaK>p4~RVpf5&zcqr9&zekR6gq9z!gp@u zhl>O+#f-{(g>`x}N?DZf*QrXk00dKt`#vi7bR{q;z<2``BKB%cWN0njB}sDUsW*QA z^B(`?vPnuYt+t#DhTa=h}IO(MwT}>)(g8as-!On>I_j1gRKUl*y_?{*ea3 zB{OAAORE5mbSnLVL{KEydXEh!)KA(`{3o&(O5#Y!{(6T^2se)0su~uq#OZM;s$T`M(7Q`4Vai;(TA+f6NRZ z0wz6{2&*Q$I_s|#_QA2#3S2xf%%1s@F4ZfEnXI-1l{S*9*hTwL95$2v2fP+@Mzs_? z^xr(1YsKzvd{E|FAlH;g1FEmLEoDY)ko!jYHEdYHz%lecFS3gg-!2V9f#DyfvW7s> zq6};10gzdYvJ`D0jmO}L$P0@58rcna!_ThKIcpsC@a>SKGp4^Y4FuI^Q|BA8=&g_$ z)@abvficiPp0Zujf4|G8my`V+kq#n@^l8Vhvt6Q$n$N2g3nkd07r;d6 z$o2=#oyVw9TU>vsj)zQ^p@aXRK=ZJD7(>wI00^E7^9cDV!VE5o={kFNpXD&b2hs>t zbp6yvaB4>`o}J&oy+|P9D_{JfGI@V8x_k%6CHgu|KR0WNIUF!^i_|ajwzIdAGY$=c zJqeg_ALi?9WAsSo*ePa=<%1uWFz4#fDjW1S`Wae!9t^rl(XJ)k@Beml6GtoDAZ@e! zrz$CKN)+~Rpu5Xw-kq-cJ25G980RzA+CLhN>S`HJMlIRwOpo5?aKhA zL&hS@w*g7C(cRPav7k6sdx52NS0o5Pzx1pos~kK7(*_yu5;5m_W@j(m1z`Q_GIeyw zqA_P&Jth|`@O)2=hH|%zHO-p!^13!PH#_1ia#?kQ-mWZ3iMawY;5+;%iakDe;<~b_ z#2M(3wt|wd%hxcg@CRHd(@8f+yMNPdQ@L>7d*X`P>hk6rocZtH`I_LpF(Kj~dZK@i zWaCn$CLQU(+X!>*&G!VVa+F2NZobi-fDz5%zI^6& zZ10|6nWmIQgBj3~s z1eW4Pa9v3IEL>=20oHR67H}L?BIRv3Ks905gM7n$w0C^Qw6ZcF9Lb;H!g{Dj^~^$b z(|9py&OqQ1kmLBwh#`643f&$UR+!qa%a20yHhG_pQh#q2%QZ*^h=4*TZLE*6wsVu~ z1+(YE2K<)L2+U>^W&kv|3=pRhT1=Ls%I135@qQvdJm1Y?7&m0GO}mY_ELlH~4%gOA zlq5kdCuOIpk=dkWA$)Tt@K_!eSDkE1fFgq>+iYS~-{?U!fpTakzs?Xc5G`63_it%q zLLFM4$?3HA4(N|9hDKIS!Hyendqyc5#*t0)Y?DmirT#&N^G~3SzdkFaDJ0VQ;X}O? zL0F#!r4v<@I37=P#t$5msMI@n;$@T}$KlW3;}i$simQ*O!?iSCUGi9Cwh>uzTvojYe>aO?GOk%fjDThCzEQye_rV#YxPr0Po1gfIeJ;TVNJ zIE-7Nd3@Q`3as)h z4Lo2O&7`7&DgyVWA1y(#`+|mc_%qMTcWp5Eo4D08Fk28$XvZ5i6T3S*pQ z(X#@Qpbeg5ZG$51ekplMIn_J!n1$HoyCnq%u~ur8KdI~=Jk;wpPQU-$pFw8qI}^JAA&_Fbpw9$ zQ)EZ4z}(ovn5rjc^c~sj&k}<1#>G;1QdXfu*jG8&2MQG<>ePnMzy(8Ph#qY4=H?ro z6pK3>83V@yr3X$N2Ys4$30$`5PXr~hXw{Hrs%(eefcm>1QtnswrKe`9%V$n%t&}TGf2X?OzG_ zZfL-BP6GGK^hhrhB7k-KE@Y*(0uDX~1then&MyENk<2mc$iOYneu!es(zDnzGD&+) zU5}3tp;SKzkV7&6X{Hg0Q>Gj`!^@{);Im}O%8dZ^9@ViWP~fsRpalcuaHad|#sq3K z5H?Bb!tIA^FTGLZgzpD1VG|6Mxq|}5$c9OglA>59)LMe+4-?8hzf8Am9DU-IL{yYY zSU_7z!%z<7DLGIS{-x6&_83@ONXzA?F5;2+(80}h=Qlg(T9DZVH(CM39sAxtZH$N*4TJtP&2pew4xk z$seL$DpA(*0qjI*iLWbQ*lVsi-SE4%$E!x<@yeRG@w>5MWL;N;<`c>7y% zV`p+q9-~i+hWRY}{wbh^aiim6y>XbXO(1qtRxm6R#_bw11MzDF6)%0PKNRVI_0-tT z1%Ug{0av7zO-==|4WK5E74UL(12{)7U)JR_`0_NPfgpwn!uLEvKbSYaZ*OrEl(nJgSWSVffcA4Jia)x zxywrplgr*pfZ(#q^-l(foX;B(3-1IVcF_apCqYiHCL`5nu?fV<3TTSbM zZ35K>p6>v@8QV>bCHx0h*MIf|aUB^u#M={ob$5WEcJ``O4dXfiVV^1-P*$(bbV297E-*{L zMws@=Pt4bY1or25R--37>S+aHCJEiB9LI}?^>>2*d!`&zw=*Dm07g6BK#YoK{=uVY zbUOy4z@s*(0j3iy0y3@8qC+o15CwW(q+s<>2m+{@s=XHh~QM> z`)Sk9i}=%Ariy1gw>ej@Jm7l0ZxKSq=;Ntl%;?(OhT-XEnm0y!X}~mN`nsCVh)Ur? zd5T(?aXzvaG_-#{i-0@d3=^_zQxTbK|9Ly<>-wRo9%dA`!?->m0Cj0dJfP@tHgas# zcZrqGFO|HCzON7cJZ_%e9VWdrpC4xw@6bwjR(3U(zKjOLR&Gx2&@M)cY$>(YR|u+2W%4gM3C9FM83&Tt0SK$M97g?eV+}FZ72Gqv*qeQ;=+Z;PQEPY z{1F^+0flKG`Yh4L^`j5#ACu6wy+V{_hB-gUy1J>Rn&JEjhwU1r3Y`K zQ0dnVx^>RShxM|>6~u;BlRtGw;}_u5?EyH>;5g$}x27j{k@d>G>mhAKoQ(yWu8!&uX$Bp(n(Y6kgMnsnP*r=3*t#V#dzDh`31$U>-MOnKkEZrl4z*VXaCfcHFE zoT%rKn~7Q`%sul9dDzxZ@uj=a|6g7mw`YdTOhcqz=UoMqfBj~Z9&M2r%Od|{Ht1+H zL8l83IiQ_7_BfyJ=09!zV`g7SP*SI4gj_L>it~cM_(r@B|nEw zG9#$6?wzV&EzLF~W(?sjON|;vYW+( z6?dt8IPY=O3I22t)52A(z&pJ^z<Bi1%K2qD-Vohv7~o_ zVEg)Bv);B85s9D}4;5hY|8v}rvxcD21s@`6;TBe%3xg52uI5nK%Z&tI2`iMRc;w`i zdWLX@mN)Sm7%4-kP@%Q=0NnAxonG-xl35V`5!rdy&aU!Vc>{!^#L9b)G^K~dbwttQ zd!7w(c`rR#?u1t?4kW$j;Z z=(d&P=ftZxikH!D@4S+nlXgF2HK0wYN0;qF5 z8Q++rv8Y~Mw6pb4e`XE8thyOp>ow_WwCt*YH#Q|n=EHZAa7U_ur3XmnExz&0J1?WcYp7W{KQh0Gawj15DRX?bCWrN?+@1Pti-7UcjvQIYZ5Uz;YJ^Gx3>N(m=_8B)f z7ds@ZD$=>ohhTPD4n^ePg3k4vfnA9_A_rqn@Y8MPQ~SD7D0~_4wA3Mhqy$(=?`Jx( z8?u@WI{@UZzcCWP4L6mYu*mae6WXTod07%3le2- zYFrk_U^PPlN^W7folAKeX2B0g*pQ2EXW>&U)lF_-1XqgykW~)DdbXZ)ud!dOv@&bt ztO3?gK=XeJ(|O^XX58jV3jd|OVhfMvl*=KlOAqxb>aHspUqa&n!Wlrr$iRfaU;z`G6^CWXiN-G;$XXlxS_LEzC=?3X`+Rjo__tWpr zO7e<300olrOB6gMrYjgL;_@9*Q*wBg+;x?fPA~zB_#Y6z(2kYvwEpTX*XQJO46q&> z%8<4+mh4O!_@`s}Vc*CS8{xNe!|LozVJ*GtXXee*Qzkc;#o}Ri-pC@pJ!6l8x9I>t zZEVqenKCh|>-+(S0&#)|b7pp+fXOd<6NXuzEv%ieN<>-?HkFoKSBx}B>A9yPFo)c? zXh$5L)|ln4tHyd!P6;J74(75m>0a@Tq*TAn`ht>g@<^EwfRn$ceuvZG4Yk%_iCghj zk6WnCVn6e~&K|rGE+m7NzxQ{+fddF56p0)kSGf?02(}lAL01HO;uWIRFX__@Ww1F> zW}*aUTx&Z7-;%dUSNi+M{CSax+~6grIl3u8g91IQ zXwM=H#U#)RO8a_FxC|4tP*MX=%yoKv3@WQjkhM~a2SRh$kcKVlb(Y&Jzcd&_GOGH? z=fNZuZS2+^J@T0hAvz!naC$GH;n%QkY^-BWu9Egjf>d<-1ar^C{Ao(v;uU%lI39Lf zVvI@znAN7X_ih6$I>vBhr;6f@EIvs36O$ahTP5U*~S6p(juuAXWz zwHln6BrYVaIHxYAmU|3JP(%m1p0u+=N7#A1X74x=zZbZ!)#X|0A+olnLJtY4uulMH zx4Sc^6O&>ec-jacsT9jL=O>hD$b(Oci_cmNy+d^#+U%3E8!GH!0vGrBHLVyRJb_AA z0GFNWROZTRYlRM)R*vgd_PtWQr<)CQJJTLovif%r05aZ@ z6l;`fl$G2NVqU}74!|oT97ZCdJ88k)hl^nPB?!YE7>>p*bPdOJB~>U_TzJLL4KLS-m+nsRXC%o54G($z%0T9*Is36V3HZ5OvgvIp@$ zm<2dKc3uV9Q(L^_#Wq6!qqqqi@ z>HGINr&^Wm7lL#h}oK$GFjf+m_v0?`jB{- zgT@4v)McK9CLuJ@rKP~AHKJz(!pV|yb9y%_e2hj}reh_aXgiQtSnIzhX#1+H)3 zfQ|Fub;tZEF3P`#@B%7!>8>5QJwQIYs2Uj`)r6O|lwo~e8ybI8UW4c>sO$Go;D5&l zsVmf1Yw$nAn@(G4258I)VI(mdmoHb?;S0^0rUMM1>eWIKSj4yV0Z{k!ZVn-bD%kml z-)|s7f<|3z!t-=dl3)DmF94B$G}S`w6S-R~VBq2}fnt3^Uvm(ZU?o;@wmnoy1MZ%O zk!{@^fys~=m4gqBcT2|z+Qyrp0Sttp9}fh$ZP z8(I~ZRUo3VujRE)o;Kz+Ks`m^VoL;p`~~v?@U%ENvH4SKZ%#`afr!5EF{5tQjj5IE z1W&aR%vA1UtR z?jrnH!~a@I>M@Iv4A{vsxjcj&)In6vUi-i=?tLfcU4J#*qBc3ZWdACTAu5@#-?OBxJllJ zbcwR09nCqsi8%GIs6jaNWjga(WeM`9eOEQKB zdI%d17K65@ERca9o#shX(1r5-J*Z11oIbC;RQ2o=0LsB2{z<#<_)v!zbrJ~${3T2k{kA0*fg=5g|L_V_m|o-N#-tf2YK?qU7Qfv#e)_DSktGBWojC zlR1Q>!KF^W*)b>K-$U0-oN(Lgcqmi{vMe=RJdePyTWo|J?V4OB?(hg;F$))xx^~jw zah0u8CJ!is|-0nr9#8 zirZ+OwkPRh{*1ffs(DM+ zzZ-Ov)s@Qa)8<9Isifbh0!v=ltKp^voCgkyT+=kqcTB9SHn@bL-R(-OBZAueozaPp z4FHTf5G0rAH6w3Ib`|_ekOzvvr6v(&J5{yIO1)J8psKE+p0LYk)Be!OAhvha3<6$i z?z~1O)u=k2X+alEfkiQ(rF)z&(j^Pt9p74~K_y=ivh8S{BGS(|mqz z=l@Foon>fy5`JFAME=y!qJNtNi=_)I;+J$?{egrJiib^!@*D}2R z&&{PPeObrY@guaQYsu)NsrTUrQ->}`9>=6a*2J{x6`fA03HbfbEuqf+D{n0W+7?8q z<-cW~v5qm=^n&oBfVzjN<~Vi!!xK|>_AYAi;XBY!e{|JS`jd7Wbf?g?J{jnVtXLv{ zS1c%-ZCB2T1o+J@)U9uEsAkVOYRk#4Uc?yu8rtE8yYvOlG>|+iTj?OL_;>lINALfU zb|m{d7_URb16|LQz!ULsN>(Gm#eJRP7mx$Ewk$2=LtBt%t0Bak1i^{w+(3n z*st;vDz*sl%lD<>Bp>$Z?vC*7=M45-PxQlSR zUFu8I23E8CGWAEZl~YWz`Y&ALGrVh)d{%~L0| z5ieLV&gsE)6YjijxL_GsW;sB6{Sc#jfH`jo%xIO=vnW4JYE?f!g?;?#A&?a8=y?8c z`{MUQwt$AqmeKnNx!8Y8glZAxdHuHb@saEhI`Ly$*vtrNh&-Fgv99%p!lrm6Us?fx za=|2b2X}KZz1A^Q0fLERCs2{1@z9Ml{09<_EEXO)b*QHeapAd@1qyHqOwiVyYPU># z!g%cYJ!#3=R@iZWA9=w%Y}8WlvFL;qMisdD3o+gokI_cPf)H$x{{wH!fCRoqp_rk_ zI%ckMic8LOu*Oa1$cNMFrKY;~_%X~-P(zPP26n|!g4U3T)@KH~hSuiNnO8NI|J%`!<+Ni7)X_k(28{*4?{`FGkKD;2II zK7Kg+kv&`-&=sK#rg%+~6OM#z1@1z%EzJ?jWGJt{Ta50^EClH}HAv1ZXkK{L%qkf} z6*s2W)Zf`Lz4Wp>eqy&&5O zP74fXPj?_U_EnR4Hg{5cvj0%k*Vaas|8Nn?G^SnBj?&~kkyu0?o4izv4IcXSJl~6A zh8X&A+dS?TRDp`6!3k*AvB(tH%8EDGCh8DByRLOTINEcP?5AM^XRJ%*2!ANL@%b** z6buiIm?T%y9*>r;BjkCUBK#aa38bu!KLR}RB&ASdr#^u|rf;tQteQD-(O|5f?0VoB zBCs$p7p;64R@+$)3F3J&K*@)7v6_lElM$WsGVFqt3pSMtYVX>fy{-A44MjMZ9zicp zjD(aW_eBl)=iVIAmCDV_BQ@dTva3Q^!>bxxvAkC)XnZ7B^`TPNm#V zV-rLUSbPu9k93XUEv4VHJF&2k`&nFyk8V><3>&Okk<$ezJ=@mRy;wFFZPQhR1FajT zw9}sxViE8Xek7~DKm11P@-kznn#GmxXWxfK-?&Yufz(cMcu4ICB(27Xnl1&3L#;E;fp44+@ctc5eUi!470==Yrou(9^~AV1ohziX>45G*}a_ zJ}i`>Yr$|If$xV*nzheY#;q_ophB_O#s*;mZvW5KVjgT*_OdbhWqLCGy@KYE4(nn1 zFQNrL(Ft{a?kR)98@+>+>HL<<<8w3XB@C!6Rep&pjyf~ZUjxxKPF&l!`)G#+RqQs~ zM8j_y-S`-hj|M-t6g0y}hV|;?`ZbOy!PPS5r7R~=vjLjl=^Jq=_u9)44YOzU1S!k5 z?{2oNEQ6qesg_ncm&`e*&BsTIh_Bojjd1hDd3m=v8Qp3`LjOH{aEotrI)V2>NsUlC z9)0@JENCi66f`TUgktk!A35?J+SHzSciy43Zal#q;FFmZW&++P$-xFPbCd$x=QcF~ zs(1vSk+WdfL^l@G_z*?G!SK15nu%@1S?!3|P3MOap`ij=!b%5PypA2B7I&bJT*-mQ z-?_h>uekIBE8tX!uuwp}e}e$s$v##R{9QYNfo{k?Yi+!JHGegQVzgRW?w9ij<{KP9Q+AA1e=&`C^2)K z$0{I2jN8t9ymIe0Ikh~^B!O`ckr{};I2iV0WvxRk+S{g9Ga9_}UBUTlJzD7|K_;${ zwXR2U8^uzhs^T^8T)o2B8Z2ZiGRcdWk-59eYz6sby0!!exe>cwd}>|oGYh8gWLhd( zL3Mkr_l|j!`vMMPsU)ZD62%Pc%yT6ph?7EADG2huugvvnOEM1B%Y+4E8&02ORu#dp zU^qH=(Qz#=Q6AaTb`&lihyt>457*Zc6gULfZ3aQQnrJS|Mu%qbvJ^a4?P$_*+m1RA zN8-x^x7$dLCNKrbR5aYtuxaMcf{5iulric2l!s83WP%h&z7n^Q!A^@Om=?Pe?SVY} z!urL9*@dw3YfW1m)j%(>)7QpnprZ5)%X}aqv`g;{-zViFLt9qO@rThAJiz_Ao(#O| zqRAsHbU{!c^~*&#!`Uq{(BKi`Ap$_OzVjWagf;je(*$UQWF=K@O}L2%TC$k*iu8|5 z7jP4QV1fK{G7IAqSE-IWwxC+d(R>@B(ByD+TP4xY>I{O=`NW$vY(vv1fmW8vrS~jm15VtQsx7U?|NI ztpB=9bN-B@LwRymS9EuK@{qYegcrC(?}PNioDMzJ^~|!;e`ot;cmOs>07h zps{Q}dRpKjV>09{mZu2kn!mzuK_dw4qb(kvAX{$krPd+{h?G@snyZmfc|g|MwWr7>Eolr_0T z)836Z-=Hc)n`|QbYQ&|Z_XMU=;pm!LD`)^7b*sinLr>mGU#i)cBo2)o&&@*p`|RL8 z;zYIXj;(2Y^L6h%LY#JE1!{sU zDmir3_dN2xp2e-yF^UN;<7X>Pvcf)iqx9zE24Me{^;t6%s*xb_*&IC_qWV!lt!h2q zgAV{6a$olONmZL}H?#okJ1?u}BzR?)&-LP6!@#R?co0u&y0)`@^J(qsHBvI_u#7WI z*Tjgjv+Yvq*z_Sky*liz|K;>JPKIrlkJ{ZGt}c2q1AmS|ijx16y#yOP+?im$nHrK?4s*ATSJi?8%FEZ&Q5tVCsCGDf4}_F zpm}h}mM_9P5|$*rtd3*D%ia63q1pBnk>ou;G`?}faaZG|GErjG%lo*@d0`MJ8#T48 zK93FTLsc+(ZShsn*>h0|=iHZ-9PulC=vFxQ(P9|&yQd(@otgTeo~DkqDLXmT`1UVi zfDuyM*H7mr9VZO)PDZ7yae4P(9};LPF2okweg+O@h*agq+37w%MZ?^54Mhf=)R2mLL zI%D#2%lqj~?F>=C2LEx#id=0XuPqh|VmfN%Hwts5>o-<&>o+>oC0nh;XE-j;gzWHJ z6;}bRJsVcu7gx9Ev*GUvH7?>x_kxw~V!WsN;cmwuJ<1`%q}ti&a9ks(?*isM=jN-H z4Sf=Z+W2QC=BbK7i@?i)K~j1RyOB_}PGQwwxDz37YenE+0XgoUjyP#DfEgNDxtMzP zyp_ks47M#|>giPCL_TK= zi6G2%5SAr@fBd5BIk};kH)iN|a@uFh8Z(`LlbMo7MSqzqwKIWy<&cwF4GIvS zd?5XgxCNx5)X?=SU;$$rc%tNd1%XEU&Yw-KFe`R7 zxxVBb^g1@1#Dq%Rd>zVx4Byjo>olG(D|iVv@A zG-Ofx9;FQIXs*!ZzW*qd#I)N-#Oii&rZZHX0J^ItZMD=eB>gl=DDj)4dEsI+HX^e? znhw8lE>i~EF$m0ec>}MY_^(FtY!+pjS<#dZ|NdUlVlAlwRqfb-kMN;BVTx57B|-SI z`Qk;I_K%hLlFXLETtNU@`AxE6e}YqnAeogaDS@bl7+Q#05DY$Z?q|K)jD7C-JYwdf zUzblaUogwTN6w>glCh4ZWD@02SD7j5jMr&fsum{r1O>6i(u(6I^5Q~e!7>9H|NJ;3 z^g7(Ym2j7bXTaSQQ!D>-gSB2)?+U}_(@JU8$}qDk#l>zPahPt$Y~?aQ?r<(hRQI=W4Lntm@1r!D9loV8YQEmUy@luHcj1z(`SE9eXP7gwqa=eP6i5NJ-p-@IM8j9$&{ zO?P9bMVmJoIU;n~f%Nj?8~_wD`cKnV1Q6V4bVvlBZ63kp@Fu?k-ez)LJ7gj&9#EMQ zXrHR>+D8F8-^$_3>+sOw=5cZ<52D_kB}Dea0UBh;9%o{`Avx^+{VPs z)d88oW6=8HsStysx}uy1qr_m)JIf5v!-!-(!jcWPtr16n)Q+9QU7b9TFB1$O*E`|? z%^gbqXxwyO7hB5rlS~chSeCkW+LZSq+W%%RSz_n0!K0ceLcvVXUCxBY9r7b1s6R7N zEw>9H=|_l|GWZh~5Zas#;mx8rEj|Uk8-wwAjg_7<-g$j~$lV~A^~%$9cv)l4XklOs zROkRKAtpOY^5;ce@6G-{SBvP(RA;2CCfMri2c{Ok%Dy_)4vyyjTR_l_ct0-zaKJ{? z8VEcnUMJjQN(bm$g&&OC`=5AQU9V_H93hjkClC;WRhit^l~=CTn$=|jVr>PCf;X@s zY75jD^eR|VXTPZ2!#5d<@02%$5YJnfc#=Ua8s8>KngO$LH{wb~)GkZ}0$&EfVb7vzG%KM2td zC84yOhA=udT^*~y9)Xt*ZIr|)^pnjhKH8w#;h;OS&|8AQQ|IdF+8 zKM&O|R%{YoBlhLaQ8UgJZ?fL*O|uiXxdDc|)%EI-5Eyf%Up+DBx`sRdEQRE3{kJjM zootic<7bz^2D1=+Clif1&Ju5CaNRNM-zVp7I@F4;qFX zne`_b7#fSI<9vey+M7DUxlF5n_O8S{%6k%po{tQe8v+fY$>(8uJsA~Gz7AX(=~$8H z(N+dM$D*Xs8WOwCA+LB(Ty`!=&{=0QfeX)`r99LsvIB^{?TeoQ+2Vc82+457+|_ax zRoTTPBV)V@PKQIZ)!D`bJj6P4f*u>(Drt2g=hxL zzmWRo_z1C7HzX5wSvZM9)6+T$FP%E5!x&6XlIqURQH40y@84<|s}dILnO64B;{*?k z)lph{S2X_f^SfKzciH`-E5m1&K$y?>TnbJf=yFbp&#|q3p5kU*bO8N3YEMWUc_6*+ zB$&vgdP0FD;;Fl{49(Jup}A~is{AZZ)Rs|Y0Y;BN)75!8>Xd%j7z5dVuO+gzje@p99td2 zMU&>H;M+<>!SGmaJtE$fG(q9b!(hAm2eGU27`!ke#w|nrE!h4hjD4G@RKnv8bILiC zKd)R)vZHsD9pK`D%KBoW`soY{4deA`>Vf9@4c{}1X_3CIr`U|ZY3MoR=9^S1AdIMG zqRHUk(%|3qLeX*+4}Ij8HY(6k4$rP)Wr&y1g6W15%crfroxx9|Vt#{r=4dFn=P_>& z*nqpYf2fC!Zm<*eEG0+zMe4bYZ6*KNIYCE;N6?<-6R2rLrc++CCKmy~*J z$bC_2fQ^6u2m?haLb)O0L7^k`PAea30~F_})^j&*++S}LJB;W#mzEnz62~I-7aFUi{6Cg*n9}C<$qG^ZbRwAX(?d`5sVOSVTLCPd(^C zN>$nsFM)<-0V&7Z)H-_2sjR$3xPY*z&Vt72Oq}M4kKDDN9EMP~;W+&28(SLxH+QwC zifl~mvr%TU+kWF9_kNAEs`ti5R5}I~9J#!pZ7cNa(-IfZ^uQOmYZnsZZ@o;CI_7Xc$!YFX`viCeTD6TfOfWWoA}2r_Ka{eIZ?5+D6(bWYzK zDMZ!M5*ibVDwP2lwm)$NKUZdr1kghhaGsG=_0obM5}7@>?MEWCzNxoNQ*))lvJU ze-f&ixD!ng5ze~Re^hy0dk3r;h`s~NF8<+|Emg4TXzU41#Y}_ID_j z0o!~w(GQ42FB1L77JK5fXl;S15BfOn>#@}=2cgO8I&IVSY9jJ4h=hp~ z<;gG|%W$mFc^6WGfUD&#D%&pJ=l|3h^$7;}Lz@O+L>xQwA=H84K~eZG#?;O#t}iXoPDV%r~~ ze$KnRGtA|QW)dm)a%1}womizj?-4O?v;3b?H5)NWh#^wv;Cu0A?FVZ9i*Q6u3({?T zPfSU$0zey(@wLT}SL;zr0KLhLKEf~hbQ!^u+*-g4-Llk3Lia7JL(N)H*v96Kwt9?! zO;3qgB3vKlXBq7$lK@Hg)cC?U-m;~6H7vAK$b4q3(@cpHm6(hj+!~QQwnf{)$=old zw#{Knxn2@B3o655dW_Fsl<*+Gn*S>Sjeyorep;Usigh_H%S51B-zz~hv{@tZ4H0C= z#(G%va%Tga(8vzJoCV*RM?LTdt#TLLc$UV zLWa#maP#sz`-f1t`17TIEa5R5(*X~qQp)D}oz|j0S7)F_w>0w)i|B3X3!~Ykn?i6{ zZLnr&J)@Y=%+Q3z*r*wclP8P3@=wQ7UrK*!XyIbrHB`uQ=>6~_9pWr$@mN@dnK=5P zOxsx?7ZN}fM36LAJ%Fgj?)4~O;CkikDC{#=Jk{zH%gNu(BNJGvn|L0%jfw{$x?_g5 zhcszn@CQE?x5H)>>vaic&ioKD*fd}!5)KK{?B7K;umFDc#nSEhNk4qL5)ahmuYWQAg=5f5w!`h(Fv zW>M>uvwLmJqm0U86QVUSQW=De?;>zh)9$U)j_$y_23v`%%a*CkP+?B;ttP1gIy*znOAe?a=14Hn_r$$^RWw` z3lrrNvkkC&y<1}Qb=Cm}c63>QJ8J;hLg2GNYe9DIom1qp#M6xSa_x`u;bzh4-Z?%1*x+I$O$^mUgW>*|C#`}8Va1BR^I#RKUV32DTYk%mjD z?@{KQ`H&W6h5Pqqd4#LkbEVYf?A^dk&SmCsQ<4HWWRh))8~;V_}3Cb z22lE7W_&!IH^+ygCVr}&o&aKFu62&)oNwbH!YasGWY;=xh5nV|>EJb7_i0%-q(d5& zsRs!)$!3AFg4m~ZP!~d)NQ6Y{E2{x17}j5mjYV55g5f zYnwdH;4sBgL&A_&+6@dZr5*|F5)-~BQ(CbXerXOn@!WSXV0{yoXYS}y>DrvAxKzl{ zX%b}!+=rphC$FK&$He@Uz3!l2ryGd7X224DiO`U6`69dI$t}&p{!rg!EGuv%=hp9n zFKPqVVuaza`IQA!5yPb-O%a!==}j*6+ZNL4WA9?zx#(D@_W2Q*R*>-Tp1A))i!&{l z?IUMz@m|~oJwatGFF8j$T#lh;e8rm&D!&<6YH5kO!`rtx7V$71+~GVOJdSSYO!dy8 zSGIte7?gh3EK1c6*q0*`s2K}L(Nes_8ZUwyZN24+Zt+xRdyJJFzDk7 zyytVzo`rx5aNcjS&|-mQ=AiBLm=H0QINOe6f#@y=Q{M$Zb^*&~9^kSf^cmL_QHomc zJ7H!8YKfp}!`nQ8*Zj1HTq}$Es=~In@1CH_V>WRfK^wSjYgtr)z895kkm+F>X`^uc z;_h{dq*!hi1$b`g>BA*hEnC`Ch_R53x>?KrM@SMiZeZR9`(@*QsuUCPI=hnJR9Ru1 zsLyMhfa7!Wfr_3*qgf7PKTFj(3TvcQU{v(4pQdGePLaZ|P#1ueX+^E0mvw6_r`*2y z+hkMTpO%reqlo8rEtoumMYyR`x95TseYL1m_pdJH)i3UHdCnLv=BqGuYU2*#`|3Ub zazNuE^2weLCSs>*DfBnrk9*=0x$xr@GWX=*rK9%YZ~ONp!5szeJD|}tPBl-aX`ToW z?bmF-r#Wv4nB3g}I=5rxa{m&;6<#jfWjr3aY1nYEEf~DLrxq-9h@;-pVe-!qzz6q$ z`e}{UV3WZKxpNldjTAbQRl-k5b!2jb?%;Zd;tJ454``8NIa>0FS*Ch zt>19egXDAQxhVxvwUKPejsfC|ZkK)E{8|<~0`q{vFR~|r4g>w7s1xHxJ9%l3v+2E~ z`~>nKQp7ADQq@tIDm8+0moRs;29;6`^+tLuyg4)4QQ!WTg{qR5(U-fD{_I?hQ?y9D zFl;_o)o-6Gp1aA;!*(yXHqs?gsCw_f3c+brqLdT>M!t#6@Ef|ZkCVSb`DZEAc1uu% zVW0tJqG4A3ai7?GfyfllR}>Y&l*`7B``0lBCfo-_mp4mUaTp<~^Me|I z%4x=^HLvIUq@m&wkv0?klb|&sJ#+lgeDUQ{IS60cV%DRav>b>Jd^!GO**(lcq(kbx zfJXHCrFb5SOS@@x>Qta2mZI#e#tT0LeeGXkGPc{n%MNy#5C))L0YnSYTM);HAn4QF zXqO^eYYVng*K)31X9K?5w-Z)1KphA4+qNi#FgHlMW`%rUda&D{vDL(floDt%IbkBI z*z}I89fDtfZLejvpEak}3o>n+3v~{z_fu9$axjFLj>Cvvc$aX;trqGUKDA9w$Z2zY z^;lm~u%9WpSgc;LFz~e2>(m3@)A$63Envs=kE8DNWV~Ey=tu?qZ=`+b-BAuY+s z>_enhEw;|qFdv-Au@AN!B zE5`LoO!JeG$`gl>M=GhQPE9rsNk;7m3*Ofd_+qht5nmPiiuE-@)h5d!tkGI!I=m7he?OJg)?I^ zDhz_JU2wpV_}AXC>^5k*V}A^q96nbu3y1RAM(JWB`~(*N;5c934*sf0dwL&6N4jGG6W%_eDz+sqPbGbdl`RQ3MOnRSfP)x zrMUKevW#33XW%vCr1&q8dfO0R8JcQI`08Q35*lC?&*5yAg!M3_j!PibRF3yZgGEt;KSdN~G*r{5|6YAlsW(5+XVjHmYF?UKCpBnyrh_V$DxbKx?Kb zvB3hs7KCxY=xASf%bu2P=yNYh&>*MFjOx8So=aNt&rUH<^cV$p*HW;C+t)7(osVaTE=3yOp z9iPe8a0VOl-#`55xMY(CL5MSld#?nQ=*{rf>yCE~&424jGfGt%H#ARg{k$9o_XkrI zGVl+wDz@Cw%|Q%RY0ero@H-BffTLCOP2Rj6Xzr7ztrs$QzIIqsn8cQPV%>UD_zE_u zIAwLh(J%hB$y9~0DJ9&{Ap!g#i6T~AXtW$G3rgh1g3ZnH9cbP9H=C!E7a zQz{wT7{43hT`B8SD09GHbg5=6P=eQr!{3xOi%XqICTsOFh2Y=yXRi%h3IDD`++qRL zptzG^>#qx1z*55apW0!2WOvJvHTYWjF{y<(Hr>DUw+x8b15f3+W+Aec$*OwoaRSXn zSDxWjFzccm8`+H~Y0h{jC}e+TRF4v0y(j)K!x0WQg(FwH;0A;$eRVT(#Pob*=)nW2 zWIdPMLMvaao$#l*i~6Fo-UkTcvA20O*g(G+8A}p(hrMJX=+9bB$|2L=#3IHsvnCQU z;m3XFkRLRDhw?^LoLAuZt%bZtcR zN}au?3N3hc+<&{vJ5|xRGHEb$VWzH($8-qkEVkqM*-@qWRF;-W;1wm+9K&0^wsMsR zj3!I6FG#~bPP$+dU@ zJ1Qll_T?*l*oF`B!?gznHYBN07FV)fYwqN$->(2KL2uYmOA37g-uuU5HJa_~=2_G} zSDs1C5KtY0d{Z)sRvo|fu^;a!T*Y8FL}fC&=!?Ff>T$hEjfc8C&0S=9w|^o|&;`UE zj0;B}YcOdo)5Gfta)iTB{!LK z?ao^+0pma*1Hojb6h@&;hnT;Ei6(WA(w>?RrUy}IDF*%-uk-&ZCm24ru-h;7JO+Y%ssiD2PtsmpbeKeg3>u#t8-guUq|95LQiJd9-Ne?W)I` z(SmF*F7+X;PyB%?+-tl!#l$jfQGG}*FfJpI$RCl@6CN$<^ykHDEYq;t)RjuIg*K5gPuON2bGJT^7LH1B)V?0WqGRp2`yY3=v^@oKPj}^zD49Jg^=4~8y9xsg zz}(;bxyAT_o`wXip8%;2*LIMdjtq`KtNtrZBJGu2B@}XRQy4pd!l7RvN@5O z-;S#-7$)IrCGZVDnO2wuE{LR7Acu+XGR_XM!#4dkjc0iKA3D0yRS;nAUcy3dkua+6 zU*lR8xI*B*JCu8g!-$Q6mA}p7?BNqq4wF3m8iZffS|ECHXteDRQ_)F;D2?2phOS2 z!N&#ttm&o|7y+Lw08& zI%67U>xKK?9&Bk}n8b(a7}K6BU`ZA&)}gS87b7p8W&%DF4S_mRsSYltS|)sOzWzA` zV!$m66O-8PHrky#IAEydLeltxZ?~*!h!*7r(akx8gcH>iiwxdw$soJL&pvUs=BkuY zqH|ql3`i`NY*?u082zX;BLswnl<0_JRRzTY=&0iMOjw~@osQ7Z$XX*F!NN6V`aiTE|{2H=5 zU(b6;4&umb6z}0_0k!H4TxxhazpoIk1p-s2J8~sLmD(mIjNRREpQKG zdL8+h9)4(t_zU58qufI^YZ6AxoyB%ahqTRF5yaz;?jK><@rL2~rC3^LXo>ImEJ^Va zH2VDxQig7Ubn*bFPf}^CVstWSVkExcqH}2-bm;ub31CvAXzlGBe1 zYn&8>+7fZv*Sn_6TM{q8xtF zE7Itj>1MlfO*9FZ6nj@?1Sbl+ZynYK9xY6pLqR~1GPChY>*QW+xuQhMI~)>2{)%Q( znEo!ccnVVllIU}Go*pOt-?wxI=gm*u%tk>1_r$Xl&`3&EoKXBzc_#R^ZG7a>-5P_? zGuz3T2QK?8x+{lo|FxBVkr;w*D9#JnG&?rX9?$YWIc0a&Fh#g5M(%RKhOj>X5~=lg zUcds0_m3>Lp$tDR(sGQ%r*W#*hMNw+J}G=k{{mXx$#S2$oWqEEUoXG%8T9fzSqWYv zHxYudBf6vH^UVQTP3PV=@MFI}%+u=T8Hr3Hc1l0>hn2Yb41WIKbdF0gSSk0-{qQa{njQSZLg$E5bj4jQ(;5xHcnl|>QDHNK%av;UMGWg>yZ=CQEdIKPi%0a zUqP7*J*yN9%TO?@pP;gyg9*bX;u;A4>D2`u{Ubamh*b;ESX@Rc_2VkyRe%57uP%FA zmSm-r-Rfx5yS)q(U?D^?wcTfk)WeAG6r%487OF(i^=0_c%qKS{90&sg?9XxA{QQRM zSEL%s@(EbqSDyDFJD0?0ld&kmvCMBk*XEFNBi7Z_KPS5Fpp$vBAIt>nMPKEjt*QUJIhhVy7 z_1cYIp2RC3YMgur79cr&Kr)xGLVDm7|+ z41>Z{w$TmNn|mHy$DKFW>G4X6JRG#Gn;h4ztBKlUi%0%fX`r^xbo6)zaOk%GJG*p( zcS+`-`&XVFPhGjR`m8%z9OdbYdsk008; z1|z314;$5q8D)8_GaK@6q0(+ABm@P>L%c9c`!F39r_F(Ll9@+|TKuKHk&4eBHe$x0 zCc;ev-D;ZXlLG&Y+>eB_1k?Qv#cF8bhO7j9_ZDYw$u;z2@r6)Zu3ZgQu~OsR?E2~yJ~c- zyzuTMrSeN>YXgNsM~Jr2eB!VLNZ7(@Tn^4dJrCs(&!8iIf+RhJ`&7y8mlrmAT0r98 z>pUj!-{-=X@gJVRp1GH064JF-6{uHfVQZ29W$ig=FmfHZ@HLlyY$=qPwt_HfdVQhM zz8O*Id)ThIv{NBz^PAK+y_Lc$)JL<6oRJGdV>vPdRex%6rc@wi?w(#+D?JV&g7nRr zej(ha_qwv5|I0Pxi#NpHismFDR-j?L^8DpJY4AT}jgov>p{aYQe#zN!E%FAe@vA!y zK=`|q%OV3DEZZ!?aNZfOBAnD#V}WLRyur85BG$tM6E%KojHuK^yz~8uGci|GV7|a| zJdQ&nnGxFQf%W-i&P}|vakI<~{`0y1eVBKwbYN?0(F7j|Y#=lB&j;AUvS1w|qq&WS zEq|&_Y~yV5q+<#S_=8?@w`&!e4G6aPQ>rxmD)<301NZFM!aHxXWLFvI4fapRf6b&+ z`W&LtP)!^VjMr}gEAM^Z7RK1^3B=VE z91zxc&%1MdTczVk&qgQ%RSzr4Sx^vxr*}F^vvG&fMkPtt7*vfGeZi3U8AeQl+slL9 zDA`?e{11vdn_Q2>*}<)?;Zt4E4k#=$8qx{jJNAJS6ZnsSeXtxwZod_DLq}yyy^vpy_wl}(xHy{$yz)7%!| zL`4pOU>-gF&`;Zu z0Ual^9O6fV5WNILVnQ&b5Hp*v$9*{tkrrNnAVLkd&%D6RGv5Ah9fYs|}ZlrCXy zQyIGyFq_ye?f6Nzk2=2Z+35t@4nHO?k%s`FslJmE!!wg@4Juv42aUb1Ja9oeTs?H! zrHyTOCggU%*>Ib6Py@O2z#rpkj>+wHK!1%u#w&C%KON=+>F9c5lv`GLO5;%OA+BS$ z2p1)MZcbK>ofu?a?98cySHFp)z}Ez{%O@BfoyBpcl`Ux4@)9ugedRXPnL?1a9nv7~ zjz21CIv+HEnEE&+;V9CUh@-h!LxNTTyP_F_Wt@a&14<`v7kcV6EFY5}IH-G1-Up)i zngg}CdUm+byD}iiUh_ODC0j=D<=C}g$Jr4LX{MD%L-h$ekO5SlaJ^#r9w_%A?cPWw5GHW-*WoGY3bjbN=*3k*a`Ynwu zMAm>0_hOG^a`#a6f+RmynH9=Rqtm=IF`wA0U|Q0+a`^1HkIPQR@6)>t*3rM^bWVp) zSc*+JX&T5m+(Ka6VQr}9Vc>NKH%J3CulYaDksA%1TddFN;o@bbMp0*%r93|d#r4s~ zl{0LBqv`Vt?B*UDI+aZeN=o>zn!Yd{UzS6^a_OblKOOofY=14(4VQR&eWRf?&YpMV z1_5ut1HkYG>?wGlV}h$vhT0?Vq6Unk-W_RY5=M`#Ylms0dWR$ICC(qJ@!eFj+8+Ts z#j^%k@cgtk{1f(kC^YfIu-l>N$NdMzjz%L$yv$* zx)F%>{J^$k<^jnc29T3rnc1{VN}LKmwIii1$g5JEB&c>%VwCv(tf=K<&^Pd@U?Gbi z=(wr9C76o)(9ifr%GG64Eyp7r`qP$XgFY;Vq^c!&5?V;VNlGnr(^pSckrP<;I!2CFZHrvQ%pONzbUc z>?if6`{EY1e0(CQZKVhn-s3$Zk+IF8PYxn#CO!lk<0Vgu>tMY`?zXzjkNSqqVALq2 z<|#RliFcH*`Kz_08_}!f-7Rkk@iDt@$xw6i4#l0=P)feYACQ0>XF}0r3P?6Jx4#mIGijsuTiq#s z>|N{en5)44Zb;d2hLAy*%%!6r<)pY@u-WW3sO*E!OcCBWYI5ik1_kSp)S7X`Rx0tt zP`EKv_2k{1P&p}L1Wj=evmh>8Vy$sAgqwpYxPH1Zx4z&8sN5i^;WN?K{*W~ZH(@o< z7PXwAW)_ZU^8KY3C0Q{4gU-S)l?Fo4KJHw=>gY>QX8(K?6gaAk9(Z%^4 z+r>^ez8x#iV47Y!^dNuP1 zP@(ovVKm19*?z_qL$NPpv;cZV!U&=Cpl$SAOYa`Nj}X-!+8o~n?8FW`B8T)A`%GsI zI=35XXqTWX3o_Ib5H;9i65mbVgtGTVyCrO!O#W?*XX-?%sPL7dCM|J;BMrGU@GI~D zbT<#af>OAId%!{6Q@>s7VpB!&$B~TTi<+F%6s3S=r!rrYG8tHcp$(Eo=)f|BXN+D7D(xk$ffdfQhY~&t2E0zL z8l?lv&BeCnQ2FV~Y_jU*UvZh1Eo?GDux{LlVtpItzaY>GcSS!9yRrEflT1E_+F!>% z)Xu1-H6S_`w2ro)HyTaxdW?ph>r6bY3%5)is(?PXCGgvv08>L=_tzn^ohy{k<}kib z5lYZq5lh0hx2mS>XZi)E=fxA)gz$E){Plg!(Xy*76nIJ+;!$$ij=RkYt-d7CxPM@! z#0K6Ok7M#%*~MV)T=wDqXYzqrZ4Mf!zj2U_pks`TAB6}2MHI+TGA-jBR+KcKGx`La z;I7Iv>WC3E#ug!7F3dnb6rDk>D#AjhVM+7H!J-2NRwQiWejs-B^-H5fowX>F3TKm{ zdyV{AuzVO(-_6;QZ9LPTYqwKjPXr;#W8`qY?eIsJ16GgOUP+FKtqEUFC7Ho#+H@rNsA{S zYlWuJzYxQJE#(KDBVIA{6DO?UurH)8E%QL^{pRW-rHbXr2y-2O78HmB@+7Fk~92m z(aA*uZ;O8=h7>VDJK=`?ZIh|CO8oiafYmcE4Q4b zduhW|SLbtf30|m(r>sA!dngsyI4##g-XGmC+`s&{j&{B!2J8QzX{L{R{8bi57unNv zQa+IBtpLrV#FaqseCX(-_mE0PyTs>Z8R5e?chr}Lk}!u*=kNtYaE)6%vili#tFJ&G z=AEeE&12otdX=Hj&yeE8qVMDpfEJ=<t$LgX> z3(x+n6~>?$d*z2Dv04(Y7}g0YGyaJJ>S697=JUQKljH|?8J^|!2Z%k&J1N++85pCi z?IeoaTPpY|`#Enc)7*yK9eC~}_+y=B%e3rdKnPOpj*pIi4F=84?!&PL#04At;$ZV1 zfrHi)&K!UChi-l);qHCC%6!&Ycc&7|x&scRFQcRCj@n#!?@w-%xkjK(x@uFUwNM^3 z8C%qPWo2<}*RdBpqCZA`4<1aO8E(aIPxqvh$6WEl2Po^&u)FL?g-t?5I`R13>(S?03Xn)|Ll}LvUlp=3lmfA86HHXPGP=}8YoTc3 z%L#qL;G9^w*_M5YwdBX(F1<`>6$nyV@x_P;CN6}P9b$O_I~?{8v-g}v5=QfW=xj!! zQ_C4av$)9Sx?`^uxh`;FnwA!NX;F=3S=iN-xgmRz6cED!@@~s`u7VQO5zzlb1rgRY zbAr9yD1B-P>|kt297dB@kFyYOI_`k{P_Cn&e6KQKX9umuudDT{ z$;=kc#)+)Ss&<4zPFdLC6(z|JeS!Mp1_vm}_O<@o;OJc|TKcr0Ix8B>N2hK@OsggV zf^3W^7;k_C%z%tlkN^iVVD}7#6M$=41WAx25TbMPg#a|pU}K%IQlML;wGggH^2r(ZkD|+WViV~dd<1| zX14avnsBGSR+HtLk;*pHz( zP~3+|mA4vRx_iPH^*Ey1--$0=PX(mzvnGN>xvMsGd$_n9AhnPev)h43VsuN)s#{Cv zP>ykw+em29r=$Mpx}b?`CZ%=mc8RQZ_z;=D2^~bNI4@%SzaVCe8jZ7XGY%ews+@CJ zRZ{7`%Qp1+Z4yG%xcMhjdZrCA!^J^?4p+5jiR19^4baE52AU$yXL5%|3a1@O?j}xl zq)M0nQA^uR-^jW+fh7DeK^vR?T!}dGjCGef3Fo^ z<+s*9IaLSOitnt%Nvt-Mwy@vq@yu(u%rR}h$h}zrSZSFec^Bo1@Ev5C!Ry>+xMgSK!KX-Jq{?bLJh?CblBjMXdVTT3OD}`@E znNvizt{=0;9bQTkRrZQNf?_O|iP-;5p1iF2hQHj;>1VXJmj&nQzQm)ngc7GH8Vc19 zH1L!{>Xew(NIgt7^u=)!h+VH z?R%jVkKd8_A_|@suzW4LnQ?tj-=sT0CTl-t&4Vj4JKQ)g#J zRpUdbNkx)|PL^(j1L)sVw;N-I+y+%|zT!N#6yaruWlGRSN?}O*Eu5WpXj?6zIC4{8 z`@DLog9g#NlTfIKAm+AC{GI&_80uX_i*e*^(wLbK1}U|qL34u|fL&{eE{HZgTUko5 zMkvUnz;t9^9wxsr^ZmOvJ95DbFgl;Kl32H{~HvSn0Uun_wi0P>fb29l+j%$o z%aV6HFC*YteMOICgv$J7wqx6Vl7Rn*hnIY!#Q(xJo;>%-om0$G`kfOpg;P)9z1c%7 zAS<$_SlPOcbZu|Sij-n-%)p2}Ms#6?s>DNI`tGs|%sy3X(!EXVQQ0*%29`+s!|8Z7Z3!U`uoEWA@;Y9*LEcC>!<9SHsDB9R!r8srk2r zrtQdF;At#!&`-NyhuC)R3}AOC!C-5KC7Y?zX$p_F>8%2_*qsxyu5w6t<)T22-KD0HDw~&2__BIU-e`^Djv<3FjagTeqk+Ks2Ku1N8 z1^qz-nqav0ZMo2GRC{Ap(esd&-VhdPbchOn&Go$| z=g=d9fQVl!;wNG2gkO=**Ft@d{eMm2-N5XtjU35P8dX@!cch7tzhS3`l<~}T%*PN81!K}iPaxmagtWY<)oJasYYhU1F@91toJqx)1gdgNvX;#RVMKeb zE)Qmibr;*w?pav|cgg}7Y(lKMB5&;aYNFM`dX{s)2^Mop~U4S^Ts+ zxxtq)Ieoq9BAh_sk98=azH;)D;*S`B9$)44$1LCBw$S_gGnB`Yx5mu zisUkb*_}8xhy@~ zXO$fk&~@2KTOs8I<(Ln@Zr9W!Q%kZhPC<&ww1q>H^w@8-74Z#cg}L(2bHLe>Q2PA2 z8?M)dU}Ot_eZUc|1BQom;E6jo5oiG!S3T|q!Edz_-RhwZp8wqdO80UVlf?#vKx#Qc zYmVk!?%+4CICZ`IYbBHV!kwIia9mZ;qG=^t>eE5up83mcqMrtAa%VanApRY_wqURe zYrd4WHz|1bA00!oPH_pk2J74=t_+K3=zRaBm)G zfLf^vSkuwV@JZ*sFHIE?f@bf>8fnuZ zl*rIq+^Gg9-)~_g``A^2hVKV9xpOGUmPxxiV^g1zJ{r$`5f*-4 zh*jFm9|>ri1Ke<5d3ka2$$tl^Q(TTH^@>B2Xt(vFj`N=@XLbT!Plw>5{sCpyD0%BP zI=+J6X1(BP`Q`4ZnJ8hO-$G6SVUu^pKkE#w!1z(J5m7ZH&D6rgA`Wb0Z~}VLjIFY} zw}cuz$bYfmfyK&iD5bI!7JwOkRU>cTf5&OH#pIiY7AWquAB320xGrXbBO>IalFRts ze4qsR>gJXPH{Qt5=o!6whm_W8Oo5s>n(mp=?1f)o@+EZG5m-HuY$^O+K$rIC+rfr; zKXWT6(QS?cM*pJ*j;oN?i1KLY?o)KUEH{9=YBThKKjw%ztkvhY@iWF(N{$(V^3G`d zARyj@F$Md}iid{ob2jQsZ?@yN8T2SBM;A3v6;;DFPJ8Q9y9T^NBUb{}njq7e3Y8wA z1J15+ik($-xSwrT5e#)dyg#AXA1u~8)-*k!!GCd00ssI@A3Q{UXvK6utE!75;L6wq zbeqTCtvj#_?JnX{F}}Fqv@SOiRn;Qko1OJA?Gj-3iz?shTo=t9Kp>zh z`iJ=DR)mwT0w1Q!)bvfkUe%gnZA{Fsi?~*xcbe&@seK8U-<%wh@B(&Py4Bf6U9tc# z%cCjN)`t=Tq&*AytN#}H_2|vCW;u$r#dxj#YEB8^#D?d!#Pg#;XoN+wnOkEis}r;9 zJ${lfb|wksO3}(S3I`O@P_H9zxYYm5EP;gT{`(POUUO6?9e z$?*uv6?N_YKb7m|Q0=^k$aGM8~EMbEki`M=a@IMNLJR;IBmW8 zViSNTBUs}IOhAnm8m>t5$eqA!}|yw^U^!QOVPiZOqkC24#R zQ6%Wh0ui2+m`k|{$Uj2&Hn+k&l>8vwkJ&ig=I%HYQJnENeTq1TC%&fDd$Apug06fR z|KfT>8-S|u-~v^A%3i-_C^8K0PS6*Xdvn?>a-JwF@s@$`*Ux;@6$gu}^%;7X(Uk9N zV8Wlal+$7gczCA756R%E7qwlj*d0*l zZ@QE<_1Ni?RGI1cc2oxB=VU~9f8RMbOm*@cgfm7W-8E&hLh2Z&+4XdNUBP9TZ(i8? zU4m;)i%(}G_p@i5*^cJyQF;3(XAOTmT66faeDG}9&3YHCWj!Wm{LP-I-$j!?pJ^4n zP>ho!y&m3wh1xT_GfL_#Iq8CCdARTVh<1JJC9-CNP;_FF*X2)BJT$=4-YlVUmSZxZ zVCl@Y8le^s_3=E(xUJMuU%awD07CUa$xlhuEt~z^!uBus>E{wkGBaSBP}ZrWPD8M} z*BPRMg$#s0jp?nRZUqPHXXe<|MO)9?!RuwLo8{4uOI&ag%V}^qYjK>rf6wL4??*&v z_49wPloga{ENF|k#+=*MQ&^1nlmN$Nel}dGb#u!vDmt{u#qPyK^gN7qp-_F!XOvXo;Q3Z#Iwh`^#jwIxG|I6p&x6yLX|+NJ!SIr=-mx+)7ge?{!K!4!z(yn zJMn4^i}#}Z;Z0lAQ%8yQv7;Ob_~kQ0YUKVcD~p1xk7B-GU%MNZ7uv&aH*g>M|67}Q z6SUeWHZP)$UK$A2fcq|xA*HG91R{*E zm3BeerImrF8BZIf`4@Q)|9~`pG1sJj$AK;Kmy0T~q?0l0ABIu)j`PVguOK3AfFW=p zhZouY>Cj9BGu3U-F0W0OB$LIYHr1^*ob+ekk24l~)_b(lrdb=h_iW0?CmJ^Ss14Lo zB}0g7SUo5dc9d|`nic`ysH5}K9&|)0cG`Bt794Q0GKWX@a4Wwq$ZDFuK#3J58#htC#Q`+n6A zGBK|OD|)1aJCVa7YNKkm%NfGc+U6ZX1m!NsuDtHXkyL0!&cAeF2!#^GkbESRdULCM zr;A{e6N~n+; z?#)6Kk)qfqx*wJL6mP*>azqNy}S%=Z0l{=q89 z$qn?7A}zMAlzag?meH zka4eH4k|UlN+&+;qEJ+Ebj(qe@fC9<)n4)36B}%f@76YM#!|BZ0BSAOu^r)lQQhegHC|dL-LkOY#DAm-8#LR!-KQA3F?mVS z`JrsE-PT;UEcIQ%`~6ZTe?lz*j*@dKhygOwGqP*ys|Z9eMt1D+Ur$STzE_HW#bAuB zAae>1>Ji1G6zI`Sl(V}7!2CpL24H4->dr)sK?^bB?O=M(-uzO>I_V1yD7s1}QL1FY zEnXI)E>SK^^#ZfoG4r32rFoNN!S95f;)7CahH|7P=jyxbFRBgTbr_Dxre`9K$-ydc z#7#Sg5srRrN$9E9pByikmF#YPSlaIi3oRR0EgL$X5(O)bG;7j+DCyz0G2zTdKR>!AM1BoF_+qT26Wks;0TJ%fwE%vOB3*<#JVush;L z^mH-H*N<-Fov4q^0lc$liz3E$%gI86&p9Zml`vFXZ#pYr}aJCc}sguG90Z1aJHYG*y~Cm^fQh{X|F%vXH9h@&yez7ifO&iOJ)|D{#i`9FG*B*z}_bJ^p-##VlxP+Kxw+ zIr@7+3ZZol70>HLJ9x=7uU9xinXBv|oX-r*raLOD8Y_k=^_LrK5JAr0uuMKUZtPsH zv)Hrpi9f@=$hy;91Wx3ak6Zdl@cBzYeNedC-w{t1EL4)9LL}66cs^*?61pZoP2cnZ z^uP=wO1=?y6L{@X<9#&I>t@)t24h zjY@P1&jYlnXp^;T$aailY)cs5kHJ@ZF&e+&xkL2|{O!)pw_v5qzUz1PSXO4!<0SNh z|8$ z+>JHyw-2v86`+;P!7u#J$m;C0W-*06c5L)beZ`VsRfs>>2j$8!+|Dt_QWn9L_0^9b z;-s1u^nf38=)Ptc$aN1>c?qjxF*Kc-gOIi@-gLjq$G$U9iW(E*8%r6d=iJ2XWS>b$ zVD%Hdo1YHh&W?~XZeh4C@T&M}Ic@9!*c}|sl;~D&qDU^&a)`tcJkl`XvTNKr%(<7H zWM*a{`nXk6z0v2+(_5NFX-vya*V!1T|6CBIF(#OvCxg}0mPj!4!v>4|@khYaaMcMY zm7VzsxfZ3N|MJ4p#)oq&Iscr%PRrUQc1@qM=(aNAI z4N@tYksNcpggM>liL0A}{L*n#lnXtPWx$JPFapJ=o`OSho*A*kk!XM@u;4v*Kpuey z;V+p)O_JJOxTrG4m3fDk_c{`7oUiVu)knxZPc|)zOYT!(Pr86pnHAtRYN~%0<<7#1 zH#GHH! zA9qYw4OW%-s9a-);9*m6p`deKMMgt%D?;%6-}p_?gu#g%gfvJl|FrTl~7*{~_p0U<;z=vQOZ7aK*CAR$KPn zoImRj$0!5eYJRm)gJJ)@+YH~{9u4q}g5Rw;vf4o^iRN_TB!!-nMfQaMIt%2FAYhsP z`~)4%$muD`B42C~Jl4RUs-{*xEaf-jX08PHY|}GP5)*f8xb3XSHIlqD{UyZ4aK$Xt zEtBymtFmQOEXuq<2T5OL?Cnd^E1RgelrTzrbL5Okyx&=MKPvynag-1?Zj8$|rnF66 z53u?t4B_34x*8vEACId*1JR@{{vn!Y2LqEI;4d_t%P zlyk^dPSHrrOp3w2F>dy(AAVewFZS8Wnma9zaZ!mUX#DdK~L8BlXs8-8Df!NCo zHzO)ca?mRWTG1NJ{=L&)`GlZu7fdBlN&Qwu51-d88NnHC^C1n;UwZ)ep zY3ZuYbs|n1F2l16O)*?2{At=LJ7CEnL!k|WW_kF5Eom&q*%|wU1!b7(OO}~jLqVD) z{2@8Xm?6T7MtEK<>sgy~+Alxk%5txxJ#Y$}HFDXwTjK^9RpJo=_qxMzynu5YB1bN?u^DaS=euRciL2jwY0Ux@!eSm`V;{Mux1O1w`f0}r~^OrWeSK3%n$PLCr(-byD}(UM6-?C(#dmR@W=c&>?p%>BbyyqGs2 zt{pV@KUmRQL0nh$9LP`sq4Ade^*(<Ql#b)w zXYOQv>Ux80=37aW!`wdjVAkOX+=6|N4|_;HaB+!ho<7BEo3|=$3;4QaOObV!D{1q0 zszR)M(WgMSnDDs4i&TZ>5eR!$g?lFi-G)e7M8!ZC2tn`!X31stQR1ogNABHP9XxLn z-F$PR9y>KkGQm@f8YarXvGyzI_gL*ntI8!0jPa{s{B;zCfjsD+X^!RPz|p@hp+ue_ zx-*rO*$1$0Ze2ERkeXZ$ap}ZavD;L{V1YWcXDH3+x zpY)h(eU+@xf|Ov?V_Lwu&l3ho2b-9ZTa@kJGVQU(e627t=K!fCpPk1jvpEhb_H4Z2 zj49?usvCV&nvQo6XA3=VE|y7@*M4O_xNuhko9%@fQ{1;KJJ;o@(jsrBO4m6?OOU_c z`6gQX9QkRRe6FGZKcyL-<~rcg(E2HBf}&F9bkGo%3N{V7;4vi1f2~QUu$YdV?OLk= zutfbbA)#?EC%Y6oKFam;>b74Hm@IcoABRaoorTTZ)6QN+QQ9*o&fO#v zcaY>h@N(Vx7Np0i1&{)jMB-2PY|)J)y3JB@7u(ifRAb0;br92#Vc)D}IE4S|sk2&5 zj~3frDrwlmG4yB+cXgX`3DIaRUSeW;j2a2tgNXzil z=(%o2OWCqV9?^-2bDwTKCD)Lx=2ZLVE7M!r(=2qr8q7bEMMIIdD6LmJIf`542zZMH1 zQ-P*$nCXPS%t>-#1nw)QS6eJxP=vP<>oDiqedU4+=%h}6wyO$~W$OpuB z#>d&d(^5iQXWu4XoCgo=!r*+nGn^_j51-6#(0G~R{g4CJxKj;+b%yKAi;wAZi7u05LEx>n*_@#;iO`$6 zmLCswVe`bte~>XKu;wEyF4LdJfS9?(^&cg!33v16Mm&e=;GSs{{odPHm3nx4v-~CJ z!#=$WLQZY#)Q7!)j3O461bF)mP}fUiFxpUt!PTj2+!?#djc<`oQqm=7uyrYeIM?S4 zMqqMGxO~aK@Q#6toOU*uSNqlFQGC=0s7b2hB7Xqp9=eZ-4FXj*Q>#mzq|_)Vl_EC& zeC~76Kb=V)H!U`KX%I>b1aPl?7E#O56=W^n(Hk}vblO`3g~;)_aWAGGnDyu0#+t7$ zzOVO080#~_$4uqOyrwBj=I_TLk781QI~yvsRE06h^R$3T=_ABnpKx3`#9*y(wn!`< z^%Km=f3sNH{i%#Xq)pd6txatFerpMdBZ33j#YmT5o`ghu`5hgKDYAanCMw%AaQ7&s z@!X3E{IGV!oUm|ik4R#((QC`1Ns?BE_16An32Ime=4l@c8k}dBw$~v_eqKsu_$z01 z00cKxLcBR>LmW3Y{>T`~q-aXnw5bVU!ESMT)iVu~aF5|FDw!^9C%Y4Vm9OqxFh$nl zJ!IC$bWCRbKm1Rqwq&xz1VHvO#XE8%UpYJ2pE@81Ai=a@ACL@%cQfH#*(Q5nQL07Q zTHznhFU>|YAj?DZI0bS-B^KICn)Do*6r1!pd|O4k3_ze~sBQaEv3xi+DH03L`{DgH z^6Ca?J(y_zyuv@^nPjZpB=9MA&U%=?p!kbpr2|{j;F@Y&)K05zWkQfewu<&D;UcDw zQ+0<2maqe|JldK8o#tm=71*nh3sy z%VphJMjwK_;lGO}-}^V{m8#ynFp=nU@KIY<&3YMbvRUs5;;HkkolQO}i8Uy8z-~1w zK{Z)|Z-;EF1vM2V1FJX`f32?|WturT+isOm2pFY4j5~JCj|3I3l!8GtiTve@Tg6xN zSS@XuqZFYQej`T!45hl=-4l%`5?AI}a9!NSsMdpN%nsSa=sg_*3X~YPIOr&ZUdrR< zG@YQc5T!Z4aE056^!9U?rZqL>zjAer>|j8Ehk~Nwox-AaXb6o?>3mfCZk#IE;6!j` zWror#m9|2VV*sjO>wl{r&U#l-Q+?rDLjXK3vo?Ag2l3}JxU2}%iyjztSb6pHxO#Ga z2%GR1vBALo><(15MBo071lYhST6gQO1j!WidG=(=Ud?H-`oIUn=_H=+u-;+wmS_x2 zK>kD-Gh9-XLW3TNR-<~51fao{xP;^w{&)dgRJ3{gEUh(g`}2OS>N?x5q5HdZf^Rz% zA{4J6Qz~inTD3lsk$;Q(KA+(nDR0!Df5Ig4g%kH7{!sA1`h2-4AKm@LAP|-MV=G0& zh^2uz`e1lHqK~7}E%~P@r`=FcE zpN@#pT#MvVm5M%eC(ab4x3oLJI{k37fOKvZ_}@e*Ir2%FMJE%hCeGj}kiaTHiVjr0 zR-zNOocB;Z2;STY@+7gqk@+~IwYsWx`)(ju~Kf!y) zzHmdXK3%!KX#%a`SrY80X~?1c|E{ZKZW1neGV~s^d9S3`t*bUZws%TJ-2a-o{`xq=o=>MDbXog#Zilu|wMmgM>1xmX#uHO?uh9 z+Zte_gJ;5VLh;+=GJ3qAGu7kW-ejM!eMKYvukrMMY*btJL~P84BWlpS!d{?{wUTgl_1C~ zaiMy72v9I5z);oGH*c!lYPGh1%`GFwn%1mF<&)%vM5`dowgLOarZs!0TVua;RnUC*A zup`S87OoyWqfjK_DTnUJHMC!}1s@rX9o#&JShz=Q=CUU;T!Z?z=@N5wc9;&h9ha8g z$ORB|;Sw~R@fqa8Tgq> zt!v+c7u*j}##)-k@!{PI);85dciL~Wy4|E~cu(vN4;sAOg(#BNjfCuB~Ja(fz}C^?q{`>w3QcbxEa8DrM* Cn(^KM From 28a3c551501d4166834a4f729f42b85fddb90425 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:12:19 +0530 Subject: [PATCH 032/127] Delete terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- ...-standalone-es-go-test-terraform.tfstate.gpg | Bin 17601 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg deleted file mode 100644 index 5be6c905cd3caea7afcfaa80b5de5066c03137ba..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 17601 zcmV(pK=8ke4Fm}T3Y1G_N-;fkga6X%0nODQk!AOX#HMrk>CMvWnM4s4WQpnll!MER z#(ia5s$8#+=w@}A?Iq5$dTuxBW)Osw0$$YmH7s9}W(xSCbAX;?0JdF`$42C%#Rqqz z&p91B#YMCqRvZjc3}PA7jxUgQJ-=RK1*pap73c@+1RTrjKp=gt*#gAzH6zBT{fB^r z5PxF--&(EbO?*wVzRYNKgM^8ZDAeV=N-aG5R}Rp`Z&7g<9*->N20kyrOH&IAr&rOPM5-XSo}I3yiI6srNiOE zw+9U?^ouR&CXT3$nKmiFEXD)QF$8#I(ULqg={cd4{F^rT$C`zuYmCa-hGbbmwPfn( z6uN7q3tj)Yq|OCeLk2TPWWyuC1&=GfHjbx zpM}}m7T`Crd5HqM+~S9t{YZoF^EoWAZ31iTV;6N~4U?rlB1=DH>+DmHHclgnGgt%k zElqtD$Y5ek*DVHAduoRSC^eT1DHsuvi56JacJ}#~GWM8j$%{Qn_jQDD*g;!)_GB?z zFuq8WB_|cT$`fch3t50?7WvM4eXsPTgs*m!<_^#~Iqfn%)?@`C@Y-~~iO(jfdks-$J&|X7S1^+@A1rQZg*yyF-r8GF z7QpFJDMP-ZF={=KH8MV!L{cv{)psM^Hp^I?gR`^XS9_J%w_EE$d=qsBQGzN$4lhZ> zPO`ccNpQ=7DC`>eKiNi!cUWk&RsFUHN4m$CHIDO!6I8CNUbUPHgqUmT=C$#6=IqtQ zkjLCW%-*HYB~7a<@DCOxeOzfBK1uJX2iw~cFM|cQYiMuL>nw1{ZT(D~p~~Mh&mP{{ zTmS6ZB!u+R;R@c<)xjt`brEdLLQHrIZ+@GaldIo$B^D8Y zO9CSxa>@AUZl)Q1Fgl~EbtWoaUXDM63j3@`e-J0h?{p{pLI!&ljMgGPrxpt?E=7Yj zjK`Cg7xj2NGAeS$$No?v8&bUWD1$Xk!^;qtb;3mccrEX>Va&Iy7Y*So4Uf~ z_*0!|U$Q;M>KYLtNo>&D>fgb9*4_K5{FWpT%L znHUM2DJMqss!0Jg1zT4pUBCVc?NJkbf8IpGeZ(|JiB+o<6cU)>`WrYCQy?8QH=1Bl zBTR&~qYh)u=DZ&WgpJ)#R4>Tn`qaU;|CV{&*OX@=HsSJ#XEAromEsFJ=dS8Ust1SH zG*hS725DvyvZXBfLA<0iZ-pxSH}dHWh3~AJM~Byeh01PdBT*wj9c)IfoeU+sl#t96 z0r$dRw?kk~EvCw$!OG_NrikvcN^WBLQYrt`|9w>lOghp*oEmiL>Deu`!0Ooy%`yQ* zF*m05Q4y~sFNzb%1zqfEwiMcv7|p$)BXekjTc#tgPw&<}^(=a;7W$HA&$!Us66F!) zaE#ZIP?K4oPb|%d^ZOUQ>LUCs#G2wKtph;RK=k!%)UL(spYP9g#i?XUh?)6vnAO`m zfc(q==&0OyP@XFW^(NtY+J2G%V19aag`S zC#MU_`Gp|sC>yd?;|Xc_5Ma%ta&h!ur9Hz?Oe8+dAcC+0Y&R2!N<-4yTF+SyQ?(!hDn=Vib0xW!1N$%{ z7x$6ZqMD6jN1R$3_SPXJ_7sc(iXKLn01?jpX|sy}(LvC6GJCefG@1awP`>()5a&-k zyPx_!efcVT4}6S3Fg%ySxT~}+SsA+(5x)qr{!i1)GKu^-d{Q4t4mY4>GC5v%7jaev zBY{ONO6=;N+4C=Q%nGCF##V)TSYi8g7U zdApk|`dyhYOcM!7HUNMt=GK1{-3s=N+}PF<5a>;)|9#rUTbCP0m$?h1%5HM+=>AP|6G3%t3sO z%7VUAV?`}G>XXa83Y%sCKY{Z&s>|ht!bVCPo6Iy}c@XTvIgE3*S|AWrKI{~?rP|9) zw{tZ*&l;OZEsV_zGyu#>aR#Dr@0Vr5E~*6;4N}nHxNfF&7_8IN_u5XFswOBYi>^ca zHTz3)V_|N5fG2V8oj-+w*E zK{>P?&3%+dH16XaEVBN0a@M05|6Hi_<~4|ZsxEQZUj{UKGdi=uBUh&g(d#3mV5!9a zWdR>>6Qf?W{TyB3L&9C0z!gG)iW(tAT}ZUydMVy`Ix&6}wWxkqS18~usZ=5)CTq3` z5lxB+^3BQ-8pBzbei1biBNDlG;#qY{J@RlUEfcL#V|EycR5YH@%x?W+ zBKYH3PFlww_=1Cubskf?WH6v$WkysdlM)Xo(j#6Mg{M`uf`b(yzqYX~0l2L09EtSt zX`=hV3wAd6KySk+gyMvsDxYDlT~&vPsR0s9qNYpqhx!~4_&1ZfUx4Ul4`U93F=#z+ z?IFL->)T#~!!aTHQ*5{~U7ce-_qZHwcR7BFEpK9EjRJJ}Ja?}4!uNt+_?yY+j&$=c1G)xqoSLIq5J8b* z5l^MqQr1b#Ye^qMZ8Qy4#_Suu{=%oZItX~S-NWp+|A6X&un-bZc3|~a z9Ab`B46u*+>~U+$7QaXO{2{6;F96#DKHG;(&w7#_P4gTJWDQH5#Y?zv(Wg4qT(2Tz z(oxZ~8^oGR5&$0ha?Xu-4P$)@;k_VqY0GOKDLYe}TEmXYo#{TMSGU1>B|};tx`Yv0 zmY{z(<)uo=dXw?t{T%IKgGzd7l+~P=M*N_&grl+OaNlu&T>K3NC-{|^bhIn%B6@E3 zZq2#X$jQ8JD;+XdHzozD7*@6|(h?$2k4D#|6V{IV@CX}G-W zan~X>1Lup1lF&WY9X4;^P&&hV^tQu&ld0t%vWyxppXxhm~`PUJSTp z;iKPs<#nl?WJSj6E0@{mnWF7khB*9ZQisMT#CanxIWDx!20Abv?yD7uz_G5<@`QQv z`MGid$nt5cC}{d-D=M;g;H}Ly#xu8B@|&v#oQnCWsfje5^6;V9U>?>P&H#+1ldkQN=)%_3HJrKPc7l=8s+PP3n4u5@j-ZienyU2N(^3 z)|ITkqj8yn2RVU(Ru^fFLu$oIpbbIog0X(UNOq%tXpnQA3XzF}EdPJ7;i1eKX`{Qi zUB-e(|9y|v(B~v`DgLbrHF^*Voc>-+g4`6;t7w5hV77i8A8{Q(0Cs=f26mZf@mEJ! zB?2ehWBlSgB_sgpCU#{+eYApdI)oVs8fYdD)*3C%&w~!aNRh0yz zJamtTkpP{VmS1;!qfYghXQ4orfqO?|n1@)TV!JyUp4__w)C+roUmJxnskOmQFoTag zh3|9b(e8cz+|ZX3d#}AX!&b4*8i9%{sYNQGKg0)c z<|&~5n)d@2nYwr}ZOe_NAJzzYIZ^~qzXcW^-}tJJ`no^vRgEodHB>4vK+QWoRcAn3 z{X<}=D%H7I7$$x)fs})^BZ~EC@0^Gpg}%Fs8yWGC~ z?R0f0cd-ZszhGnS5m)RpMMKEQTQR4|m*mbFAN;Hp(&FB_G2K`(9G~t5^SRv?0(AFT z|6fq`a^M+~rZ4SO!NXU{c=#Adp@1i2(?pPj-Kznb8rnkq^nI8EgMl{}8VW~iTkL{{ zZ5byBFsB4Ld*7#%-A5Osc=&g%$QYG_cX2VDqJCx8v*duU#A=QV@oQAg=K0U7S)bQ= z4WYz~JbYcWmLfHs22R;e#27@>w7%^^*)L;ZsBO1cc|_C-7~Go1TY$N^us8zg%uobdK#udmoxv3PWZotCu3QUlz}_hKi1 zqG2E#4(Y*~_V~I!=*Gh-^TF72`<+f`j}tk=MhQt5r}cswKQQwoe- zAd#{T0edcdU({jSYm+(;_nsfC09+1Hs&^)>BUQIq`&b{tc`?edc8^>bPN0t?n4&*YiNVFD!i zhYb9(Y@yurfv#Qdqxf(zWxqzByZ}9Rm&}6Vc{vz)!3CK- z+-M#En+ie0(aPn`7zWA}WGL;^#(Q|mkw=ICE_#kVJ7GVJ!5<06>ZyEIVJVIN+o`<1 z>66L4F9Hyitj?{?lNbiN!5hQIk8Q@PKp{hRNlxAt(tm^^!U#`ZVP+oSqfI^2ElikXxT_OaLe<)#ShKwWLX>@oOEz1gk&Gb8=A z3tyO7=4-Mr%CjHlZic}+bN?^~A0{a%{Y;`t@Cm|sBLL@iH_E<0#DSi`_B^P>>FExK zymN{4-7!!x7GVfUxB8LD;I#d}s6>|MQpi&Fqo#;y*iS6+SZ&F*i%qZoB!i$po760{>8H5>&cGAX4Ax-%Nq~%Q7 zRp^uz#L;>DAkz(8*bDF2M6=U6BDbZ&JemBm2z5}d#Mz7jn@7b#Q`sr; z-m$f`1Ok3q-u@YztU3RXbG7B$3KGMRUrE9Tj#xIWHNE3c3IQugaX$gu>g3Cd_vm5{ z5_-hhcq)$|!-UvH=im8SC=BJt-G@HCdCq~MNIVC|E6|dSn<}F)Cxw(e?!5wOCtqH( z0o6}dGp{m_#xqzTfb6d4FSz5LiD-&WiA#eTa3K}td%ZjCyOQOUtz!MNkmMaqSW@4G zevusDP9S52j-O>2)Y_EWM8S)p@NNvVf19tvj2(FnOlzucY)&YwUMyr7S*HcrvMiOAsR=0a>xOy*)!d?t@*bDi1 zLn~>_Vfsvxz9}Q_tyC($&r#|als|>xf0(!)Pt_%3l+ zL{Ny9W1t57E2FDFq8Hlmnbuo|*^UPzQVOBr58;1k-oqW2!t4E<`vl6<9L&?EA5@Aa zQS2z%t$YdRL~A|Ic!$Iy?}^1$`-f5^_~cI!`|YK`ZDW?hh)^oF!|<#-*65Q z!g!!fK-I(L$-gLQj|hkR^t+>Z{n%5kQ6e2`xA`Sn$1@>!9Ku}0ih1;E>eyeZ2KkR- zBIkYaTnOOlBdTQllm2^)3}`(CdX86ok?RtVfj2~CWB}~_;bv~G$bxuIO4jwLj?};O zX^avz{h;XDz75hgfr#CTN&gp!W1O-HKJfo}T~1{DRZE%%tsWcv>wPBtJ#V(jCcoP} zt^#3Y#{21(xQ}p$T%`K~i-1E;kI)C8B$vh6iRwIDEzQ8O+>mhGyvmcM7KIIq&eLTn zEu2vBhUntEVL+&}Q~ZOjy6^xoKF$~UXlZ%Bhp<|vQ>d}!h;xM6CzY%w?e?f^Lf=Q3 zJ;1z^yIn{XJ>fPlYZj(c@TVF2VShE_FIiq>i(mwt_M!(HsI83r8UYN2aquBl2B(5x z;`bD^o-6fRFHiXJrol9Ke}+#oopseHkkr;y%U{=%j>Ay99S1T9Iiq|ZqXE11{Gr|0 zQ0+-w^{4Pc!u(WuFSg*5H!ggKtj>|k(2&{+GlWbT`7wmK~psN>?~we8>pL*&tz-fVIX#L>vmg!YSXP-o4^ zGR7)EdNjCbyGC{d`@Os(K$H<_fPo;8MBVUPNw@c(jkbWCc^XH&vy=Ai28%_T!f8CYnnbq>5xczcA|e9`2jtMYkX7=r@z zE|=_^JC(Ta>Wd32Fl2_OgJ@%}y*4ESaPgCakyGF2NmL|O*PP(@Sa`_soN-;w#A}4h z6j%#45?5C%fyL!evc$pygPBJ%TF8W|(UtX-wPZC77cF^vKhy0JV)(Id%LynX4hk+4 z?-fwpZ^g%*<;aifHIYJ-NyvG~MY(YGLBcrH-jGu=N)pmtZs;2;h!FX-B>}y|JL2&$ zj~l0Pj2q}cJ=O}*?I#1WU)*Z?er7a52eg(%;|!23#xf5!qT-)m%;e!+!C2a4CzTf` z9e9HWbD&7uhv)Tng@YY94lB@8OXovt*KhcpM$-1m)%`9oh_MK?Je3JTSWH!mPMx|_ zy;(g1p;*3L5$54tkdzi(aM4ep)_@?B$ZUNML&>YJ#J(0!q|;gKQz)_Wpp7(Mg{KWQ zpOmK$X%~0C1J-mQSMSo@2C(dUI;h)cm_k7_5>)1@BIf4yi1@XaXCxlQN0J#xN~c?X zM2%=*uWh=!Fwj^3Di7NmVS$L~aH`{sFTODEVpdZ49NksEd#JRZ*{h!$nspFag+Ja2 z!8La7e5}ih#tfaE{TuzXd({{o%pb0A$0fPQUm^ij(@Vo<=PPi{$zF34{?wIbmAKf& z4qDz+I=dO3^Qd?FCb5L7A@OE{X{`8IIkV!6DK?|^e?nRF={+n=&AVc<%Qy#=1+IwW z*kfyoo^_d_dJim7RkxwrG`kbeF)>e?TEqr6=+36o% zKJ0Smpa%#N!1AT&d*06f0r-~5Wn1g`5dxzei7l5>lz`QUr?=w$cjTYn_LRoh;b5_C z9Jd1awoxmgM$-+JHHAE@Sr0f+_kN3N2?pYg-M#Ep?*xwx1xX*80Xn>Y6OJ43ov^j2 zGaGpcbtyVJFxh#Uq+$FwF&BYxc$j=jJD0=^1d>$$S_R}1B_zDZx>teBVRY0_sd zo2`uPlWUI~-*%+M`&qtlMm9Jd^J-J4BWn_8`*KY6mgQtf(l@2{3*z*lC@3jY;5j4> zp(_`Bo>rO6FI0QQ>{lb%5GKEQm3&BkkTWpe9_w{KGuvv315o*mOta>6ne6EN-i2`BsLbXIM3>{%i5y)rKRx<46QzH1 zT8H}?o*S9&Kq85o6}{Mdr6ViG+oF7Y252MKp~jk^T2ht))Qq6wY@2miZf=V0+hPw$ z#6u4K91d(!s*5BIQ#a=R8*CxQ)Vb}M`h9Zdl4!2-U0K6YqMnDMCV6OjWcb-S5{i{G zm3dCZ^UfpS16^V~utOuCQf7?INn()oxQY#0Sy2?h_lgM+yftb&GA*8?b2e}`Cw}8U zhg(!v2IUsRvffOE7bq9)gjw=FWj9CYK%CCnFAr0S?>BM`@F~! z1Cm#BK*sJ*)Pw&Dkao$xbQ9Xe*CTYH(r->4lB3PE(`<7{abFuJt^ZVu{sNiYu*oPB z`zWy^$9;l77-DU~z{OA|kEe=jXViWRV_N1&?akpCOG`X4uzepH4ylXN<>6s6&QGy; zr#4c0wv#=ob~#C-n7Y~4(>!h)U#_e$zeE}=x5W9W!A~x$1SWU#>KpLf%e=!g6KS)u z?G07xUentM3()tn%#p1OfBKO_3*DicW2wso=Vpb0N6J;0?v9-&yQFd=AgQFbfgDUB zgo2wnczpIQy#{qYQXWkKuLO%~adzyz<`~qvuXf*?#U!8Cd*PK`I}3$XVH|qa8^WACw!;;b-hAQO-^#I zQCLg_q;KD2x;qF-t+dbt9&F)7@^|B0?Sd2(E~o>`L{TlIF`5$t!NXOx?>bQ}GDCG&B`itTqB&x%+}x=;XCiRX&p~Y+7~%|j&An|if{oUasv5IA)`+z( z{}MTJ7=O<|{d++94M}Mv6plR(L})vv43G12L*lWpxO%MNezZY06AB$n<{bR}a$pMV z+PNrBmbp^Vd?N#raRcnl8q|(KDEY_>DJt2b2u$hzUaRq%LT-~`#mtZ_WP~$d%?bk& zg;N?zx{NBj<0(AD^ag+CRkOyiuVyT$rjJ0!#izDpc}EYU+3RfXG5qe!KgXEm4u5+A zd9)V8$9K&3e#RnVnqPE6h0HVJ(+~4h$dqdg?B=>@wa~j1RW~%@Ecuy79^O% zyydksOEBFJR%@zpJL)_@B(xZ1)$OF&D|!g4n?^g00-ftzJ!-K*1RhRa9ExkS zB6t&|6U|<~9nptO;fkHd8kp;j_`Ql8=+D3bao-*oI&?7?8DOPH+f!515%a;%l?GLC z?xam;nLqLM?nlrtrl2-xsDxMz$oUDNrTZc^vsh8)ERIDSaF7$9JC&EEe^QzTL*U90 ze!u?pT)T@vRAR7Y1$JC)c$bvp(`|F6sV+|dur(8_nAS;fhXNk^lVjNzZHt{@RrwtL zvqxjT$?LJ#R+xUGlL69HD7*>&(4EFYev?hYVFXxja#5LCPa+NeT@D>cAc8-WVNKA1 zf_uJEr?fdTZa@Zjs-GaYwRbP8d)mowaK%~BroUZ%C%2rxgd@%Zzi%d1YD{> zxARp8Q0hXI()~K9;p|tec@9Y;9O}pRd-9XAxAv_Xm+pst1&pBt=(a)P+u_5c6U+v< zkF&}Bg~Q(A1V}H`i4+I!bDWajN((WOOyq+v?&g;7@v834mR*23>M_#erf^?YfiXjI zZp-x1IBMI`8Ht}hWfgBFI7biMJ?FM_{`8X-wzdpsQyc#oZ0oAnkOM{|L5$Tu`FV+N z>002+{vaqzESmS0sgzVLevOD2uGLs$^c;N`!;=_fq7JU>=X=FElZa}yaeHbQ;nSuC z(6fqW*jyh!)nF~Mg(!9u;jkldSKsDdsnwOz#nvL@1iKfiLdF40v5wEC)+o8|w3WGz zhW|IJM*Pp7Xv6jCiPp}GNwG6}bwj@Ot)Y#9CS&c=Z#TS7+{B|GdGkN9K*eDY=p}R~)Jd9c5>Iy!6p{o+4Ce6RA{7 zS_EyTjnNq?HJxXafS0d!EedmuA{Ww4v!9(PYj0CeM=}4K_mC^YeS7sKK%Bo2%|T$? zi&8(NS+nw!b+!_o3Y)Rn>Jb>>CW?>#OBAzJ;^<`b|B3?FFHnanch@TC?xVk4czntT z&PibR?Bc3fJg!G+uQ}`Qdl1!Ir;j-hFUR3xThe6QVYTZVsLDBHZn`pOUpT^p!F~-Q z&j8Nr{7kh7_qO34BOKE8Es%@7J@k=7p?_(BK%8okNmPe6=ArcB2aIn-lam$oDNBI^ zrwO5ybrfe4Xq%#Ae-q_QrZ&_R*_{I1v35gOWSXd*Fdgs!DkgOW-P|gWrzXEtxl?ql zxJsV^f|U04n++JC?!5n7nE8ddZ(b3dRBs-#k%g*i;N?*d+^0zQe5#FGG|J~bVIw_B zvdzy2>Bt=d!~QwPLJ&~7kqPObp4%$$DBMtaP)zgd$-YXlH6GPqOro6lEfJe-pG1XexQql+fy>MoXRF*ow1*V%-5qwOdtf|4mU#=vbihTAG`~^1OnApogHW$2UJg zt#i0)Tr6oYr1~G31jd>R>JA@?0hf)7(POx9UZL9H(PZHgC%b_a!$=B1^tB5*Al?T} z|7=mI)!2F(=->+EaA_dF0V)A(mDPI3L|e0Ph0K#T`n)0qxwTxmN*cCI)5J!(+_BqS zNO%;mn9{8oA~6wXk9*F4S#_9xC*X1uh*{MhhVcP|vCU_%p=6Dm3K?#i#{`}5Zd-c4xg>_bH)G!i6{@Uy|$O5@ayZ;?)Xp2P^Pn0uR~ccg(#>ycM7QUm)PDQvMQ+q zzt}_GTup9$^O{zopSy_Jaal zoJPhq0mdpjiD))iTRKR+G|So@qScF`?HDkRo6C+*<1P?ExQ4BQCidY~hS`nt3`YfK*0_1@}YIGY| zn`2#!s{p_Gui5-U*|b0tm8smpxC^b%hl0`BkjWF+(mg}nz?@>Djx;~%XWxNBLGlgKX;A{;>M?6@+vt#1dGlYXNz3}F(}ET7V-`Vg zP}R;)#Al~y#{Q{XU=(*i-tomRu|n-cJBU8?uyQEEz1VtbI8g0Ubayi=H`%)*{E7kY zCBAu_*~e~e5jWuNp?^6 z<9x7p*Ai3290B7&09V%}7(Jn)iD(50OUjIf;kJLr#%y_iHdHj&(_kBBDzNK#CafajtzdS z-H;1x=GX-wqLW#(w$sCiVBx5Yr`THhmz%io^&e;tErHEas0o^S^F})S3nBJv2iQKi zi|8bLon3+5l{kYRP=*<_ zBcOwvnlV9+dj|{!o-wQOU0N3J8F4~XX)4I1zpD z3qxPph^9&?YxsXheAfvq{gIG0*`jv>6Lv90TJkdXN9h5e)pe+JbZ#j+QBsqjX97%* z5lBjWRA{Q3iXb=~siJB@D9(f+d@umzt=z7{;k#s+xU9`C3>8V^g3`6)#{2k~D#rkY zJ*U;QmuxuBj;6SVpBh7gW!2|D*1?jz`+GvZA0!SrU`|GNz73sM6)F<2`%+0bR9&gY z0(SE#m&6d4O`g_qd|cwCj?zh-$iZZjt>T1Jf$FPM2bT zu_O_D(5E-B8eeDr+J}eE%5iwjLDq$|EJfHaB+EHJ`0;NCQPvRTR!Z7@`a)l84Gy?~ z=QD`(^0?R2()$E`E!qGczoR+(5a*LC?AHn1fKZh{L&0VH=6-v-KgufZ0qqaF?;g-s zm*YT47IKem9KwF zXhVoOTFY%)*bVHX16ql;g=c4C{hd9bk?00mx6H^!4NQKqfHtScsQ6~$!{n&3Q-Z^H zcplNT&jgcii0M*Wi^`_2_`q+QBYy+ha!WswG6q5dY^$zJ$MFEr_cDngYE%dZUEVv> zMzo$|$x6-bKN+52DNC<2&IwU*MVWsSrLgTRd1kdZfF0OTtykjo<8u2hwI@~m`LJ|K zf25bu7U5@H7nZ23TV>h-lF9uf6#I{yD@RY9O7Y6c?(tY25In3>om8!0H^k}~36@+@D9{N26T(K_a zY=rF@L_I8*pxPS3d$bY2Wo!dH4R^*Ge}`0lr|~LfeVG z+~P5qZF_FO{Dk7uA(`p~*YowqQZ1E-sRtGT3+^US&rY5Cw(X?!Wo--fPtD@^h{Qqz z3^zw}#RwsqIa9e;hoLa@L+m%&Ml6+@v2et~OVU`tPl^~J%gg6mhDnCw_4z7{Q@lC9 zTU4R2P6ojQlWX9I1HO%d;+B!=@pratYB3N~b z%ou_80z~>7uD%{D2t||FRfLCS{gZwArIi>_DaVX;clS0K)+1ol`RD+RSg0(B4F4Ev4)Qdm{? zqNoA2h6ZKTl!$=|Appb_xRVndTGjhD&9%wu2~3)qe%RS$NfucRA2Kb!wb5%Q%$Fn7 z5%~AMr4fY6bk$AeD_-VoZM-r>m5o$W0THq(J_TD{e)WM@G`2!P=9I798VK3A%}sV4 zT%0(tjKkx!Nw6{gi-oEEPqS#@~sVrABRKG5H6o_W)3(*lA_ap>U;psR^PrX{%Ds{@2AoaM+rDT%YO z-RdCxK6OOTB4yYxNGU$x3ummEsN$mJ9Q=Ty>g57yOCY;=? zFuDrRVTL(`ZJ=L?UR9!zo=g>q5lkhS)D0Elr*qP?wiM1PE|%sD_U7wYSFW7cZ>vmV zem|pqU*vH09W^uuPRMFd@f^W4jbG;;^NbvA3UzgD4r&&5zVVrgKIwY$gU<97@9!WV zQhe2YGepU476eV%^3WQ8s`XHqp`$=-G`~pe)c3{WFQ=wctKZDTW-C?1 z$p^B`%gGWhMAc#=W{0^9aP8ok2#@8ISXxjLAN^`rdYZ-9hJ%tNNUX+_um|(+l`q2g z{t0h`rDND)t0H4_7~0x6e7e=3K+YG-*9_EYTe}?ixsf4<`6S0%&O;nz!uIW!i}ILS2b?=* z4=W!NR5r}i*1GG-K8cPmD)bsQo}N+`H8U|X=K=#V$aUlJrRBBt8G|!=l0|KKXAmLm z`sv|Aoiv36;&+d44~Ku}EQW|M16KGCi>IEecHsOt$L=FUOG@*zEE~IXU6QOUqGEe?sJB_MzLG-&9Y zF9iZx@MKUC@B{VzGbS!wB9G;!_`r23>vFh@M);p@3ekN=pMv2hF%FvvrNuyNEP!2Te{c zL(aAr40czp#RA84tkDH3mZnz1T;x3_?fqcZct^(O%fIzLvOp0Vw7M_-TCXY|>`*!# z_g|!uHkpeGQZN0vU=AJDvY3*2T5ixF2SSK;-SD<#)d`AQV& z0;H} LoVHpZ=W_sbB_C1GlME5&HI1J%l;zwermqwl0Bxo_Khl}p+blBwn_GWBGZ zYC1UWs`=wiVL!;Tr`k>};c3RezP)C8jgfJ@-iecG0|=0+8J9`Q5T`v0hDs$1CtJcm zw%D>Ae8y-AS0X8yyYBf^MiMqs_h@4Jnx+olF)iNhnUV}VM&pe8mJ4X(+xdnsv0Gdd z1(Hl(VW|<1JV6h~53kB+ccS4sYC?Ixe7 z3BIM2i$RW9aL>kWHI+GH#V>VNLu7YCtcl~KvJ%ob3l(Yzuh3?wcCDeo6{fZA4w4Q^ zXAH5Qkd`%CfBDHzdk_M7_K;WpyI3|fhlDt4yfNd8kwnFQK;B2*Y}(5hY~R-y*<4QX z7$PMT;(!EY5tsRy=hu5tY>coEYDP?bk&4ksimWx2~}oe zF{E8{avC+p?I;{)$)#>+csN1~DI&H_6p7u)pt6O_?PHh89QU5P?Sxw8BClgyi{lSB z;M>{Io?T&wTI1}KcbQ0a6{T$>4}qB&|0EIzLC=hoTFU{_hDP8nERi|z_R;R?At&h- zT`)7mXOgSt}g*`)1h2j&B!Tj>SS2Pf|7$Uo_YaZ*AG1)ud8 z)@6DbFuW2@)(&(jrQ<|#9-bgjesJ<7^Km*BOGWa4&wQqStB$U{Kh>7w2ArYPGOmz( ziwkO)K-c*ir&&o=U{Fc%?5@V22wDKcsG>-{5uH5M3(L5u;9Q(t>{c+XHtFRmSbMAk zw?*5WnCD{t003`eTw0ulkoQPHu~!ivZjF`JOcoq!k6vjHoB=USDjs}aobV7ft^o_1ZH=($dreI z+SF!!OiH`;uS?X?pinDCBanEM7ZgNyS`l%z1mYtNyGUA48-1_ZADcjepn6*Um5U=_XQ^L=)SxPBgcX3 z|Fw#vXwC9uN)mL0Cnuf<$pA}P-P80DT1vwfwfFa(iQZ=os{bwK@~Xoux>1>2!;zC2 z<~ zZhM-cJM*FD_m|p5JhqZ(?>hwMBt}N$n$}+=w;w{MuqAaVOEvO)YnVQ0GaE$8B8P@s7(t5AoLQ z_$>KO+{pD^My-*|^cT9u>j68o-w zG{y3s0$dZH{)=(zNoz=-w_*LcwhQvnHhP234TW3faSqX7pT-jp3T~KKW;=>2Arka% zrQqnoE;~}*^_;S?cZ#4*IBo}jdrM1ubtYIy`S+DvuLc4)&3VQw*j@75IBo|N>SP;G zvF9dn$G3zY!kf}%`;(^3mTyrPNuj{kf6i9^4^ixr(;}}k0hwqPe}1`Q8%-mC-~j`YE`W8HO* zKDt?x-C%GhK>lU#UQ^+Sk|Sg1CSaZV^arRzUCrsjP1E z-m>R?_8S{S!+aVmL(MG77a!bN31$&tbnF6wds0kPS?SLVc0F@BF8eDXVMLarFUA+* zi(~5E1tb?uGld;b$b>PdRXuViVcHqcuEn^1kDlG5B-6U#cFzrP^b|#RPBYPWfpiQ) zw)DWcB+s{q;WL{Q&@u|M^qq5dQ)Dv(g6tklR@KrC`!h)C0RUMARTm4Kj?BwoD8Xb* zDJO{!3Fy~&I*Dqz5#TZst-Y_yRFh`P|L8|8Gz;U%`cwz+GoXAvb+o3l$Syk=`@$#@ zR`NN*QLzCa0vyfP?K*luM30w6;;_WW-otFv(5Ur7m6V(WOv{$?jbHbDW-;}FTwzI4mgk)o(Dd95IL zeu&PgA3U>{By&qCG0H!6=@F?O_722Vf`gm$p3tg1JTUh7mS@!#04qO=`Y6W%ka~2S zr#PH>ht`BRrdg7FN%I{>TnO_RJa?UuYM184SRlA1@TkZxW9{jas`_UuRx=|EyU9CBR zbeOhf1|VdTG^tCFOf~WL1>FB( zh?zi){jf2LXR?J(L(Em0v~nl}mW`#AB;Iv0zZ`EvZt-U34j9f^Gj!rWGV`9+{v(@$ zRX@s`GF`hFKLB(IEdQA7&?W(`uD)w)=Q<&S zJms&)$do6{9qfa^#Z9aHpa(B5k)=#^ty|tTEsR!O88dywEwB?ZXd*Xh2pAliieoIY zGY3-QtoFWbPkOaI za&-Cy?1=l{e&?a#ybv(D+SF+3gF!L(q4~a#ma$OP7OH{*lZ`)1#a%7tJCs`DSHmt~MKXHJacR(qY zuxN2iImuU4F8241d=^U`YiHaLF$0feVNf!Kr{4C;e}@j7!$?io4nYtJLsNKM{7LEm z6-jzp7iuRmP0e}tY$|KHLaeD=LuJiu`YOi0U@aPtp!G{@bHaL$o~#(SU8M zIa%W$eY`6qewA`WG=%mEL0;E7``w5(#ddsuIQ2k71=VpCX!Dq94^>VW;z9-bf!wkD zEa7X&60I9eoc}wJ594i%*jE=Gi`R!REKu=HLIR5n%(UgXc>Q&}S!bMuZq43LZy5Ei zsMVxNW%;?Pj({qks%83V+=xWVflTgSlQVnz|2PF26}bp)4L~$KNQPv{Xvm^V*T&`d zBehin&=YBoPwxqG=Cg#=mI2;k$f`$K5vo|$Nb+qn4b(XL-{3tfd^#!<*k3(#DhQd- z3mcnsv*&ho$ftd8&#N9Xz~KUPrXFy2<1b;bKZ3#LZ=Om=wYFfND(5IkGC{L9)EQ;OG%YpP(iSR z15{~W-YL1A!|5CjM#eVSRJuE*RDRu>K}zuH zMB{>q%|zpo&o&T+S>|Yd9r@w|woxgV;R9(J*!cHpcXc>Sg^Z&XPt3?06ioai!KuZ` zZ9GL-2h4PGt!35AM9$5>YosSO7`aY0?*N!R>v2j>`wG^(L} zH1(|Ys&O}u58P?dhcO;8bhQkn&o5})^V5QZho?qf;{D_&qQwPVtxfS##uqeS(-Phfrke%0N!TgY@`-X@d2 zk4~U`Q*CQZB)6_TD8B5Up$l`%TbM};_TH{rYlVASV2Y9AvPTX54MwD#=cM)tN5`5S zmcf7fczSydI~=C63n+BY|AE1ObF+6~vZpbLV8b&`{imjX96dL^i{ML)`Px3IDO*dLvH(>Z1D` z)6*J|aJ&Ng{`35?ds6E3gnyMCFNzZ%P}BEdCL}2u4q*aTQIfR9@un1Z?ib0L_KLFc oUFSd2BL=wZTQS@Zi8LJrJVvNeM`a(3L|jF0THz)~toWjSD#9F2yZ`_I From 823c58235ff2d86760e6a68355466684b365600c Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:14:08 +0530 Subject: [PATCH 033/127] Updated aws.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/infra/profiles/esignet-standalone/aws.tfvars | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index f38f04b72..85198c9a4 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -7,16 +7,16 @@ # ============================================================ # Environment name (infra component) -cluster_name = "esqa" +cluster_name = "" # eSignet's domain (ex: esignet.xyz.net) -cluster_env_domain = "esqa.mosip.net" +cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = "thisisbn46@gmail.com" +mosip_email_id = "6@gmail.com" # SSH login key name for AWS node instances (ex: my-ssh-key) -ssh_key_name = "mosip-aws" +ssh_key_name = "" # The AWS region for resource creation aws_provider_region = "ap-south-1" @@ -74,7 +74,7 @@ WIREGUARD_CIDR = "172.0.0.0/8" # Use your actual WireGuard VPN CIDR # Rancher Import Configuration enable_rancher_import = true -rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml\"" +rancher_import_url = "\"\"" # DNS Records to map — only eSignet-relevant subdomains # Includes hosts for both the esignet-standalone profile and the isolated @@ -94,7 +94,7 @@ postgresql_port = "5433" # MOSIP Infrastructure Repository Configuration mosip_infra_repo_url = "https://github.com/mosip/infra.git" -mosip_infra_branch = "es-go-test" +mosip_infra_branch = "develop" # VPC Configuration - Existing VPC to use (discovered by Name tag) vpc_name = "default" From 3557ac5a8ed6d28394d03373a4c7b842ee980f6d Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:16:16 +0530 Subject: [PATCH 034/127] Delete terraform/modules/aws/rke2-cluster/ansible/inventory.yml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/rke2-cluster/ansible/inventory.yml | 46 ------------------- 1 file changed, 46 deletions(-) delete mode 100755 terraform/modules/aws/rke2-cluster/ansible/inventory.yml diff --git a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml b/terraform/modules/aws/rke2-cluster/ansible/inventory.yml deleted file mode 100755 index a1bbce466..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml +++ /dev/null @@ -1,46 +0,0 @@ ---- -all: - vars: - cluster_name: "esqa" - cluster_env_domain: "mosip.local" - k8s_infra_repo_url: "https://github.com/mosip/k8s-infra.git" - k8s_infra_branch: "release-1.2.1.x" - install_rke2_version: "v1.28.9+rke2r1" - enable_rancher_import: true - rancher_import_url: "kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml" - ansible_user: ubuntu - ansible_ssh_private_key_file: ./ssh_key - ansible_ssh_common_args: '-o StrictHostKeyChecking=no' - - children: - control_plane: - hosts: - esqa-CONTROL-PLANE-NODE-1: - ansible_host: 172.31.64.165 - node_role: control_plane - is_primary: true - node_index: 0 - - etcd: - hosts: - esqa-ETCD-NODE-1: - ansible_host: 172.31.73.182 - node_role: etcd - - workers: - hosts: - esqa-WORKER-NODE-1: - ansible_host: 172.31.75.46 - node_role: worker - esqa-WORKER-NODE-2: - ansible_host: 172.31.72.215 - node_role: worker - esqa-WORKER-NODE-3: - ansible_host: 172.31.77.135 - node_role: worker - - rke2_cluster: - children: - control_plane: - etcd: - workers: From 5513ffda0a8b05b4d69749c20330d866b5179e2f Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:16:24 +0530 Subject: [PATCH 035/127] Delete terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../ansible/esqa-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 720fc904a..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://172.31.64.165:6443 - name: esqa -contexts: -- context: - cluster: esqa - user: esqa - name: esqa -current-context: esqa -kind: Config -preferences: {} -users: -- name: esqa - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From f787bfb2ef53c430346ad554af744947ecde3fa5 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:16:35 +0530 Subject: [PATCH 036/127] Delete terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../esgotest-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 9681f1e26..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - server: https://172.31.66.49:6443 - name: esgotest -contexts: -- context: - cluster: esgotest - user: esgotest - name: esgotest -current-context: esgotest -kind: Config -preferences: {} -users: -- name: esgotest - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From 6a6bafecc7b21e38303cf79df887fcd8fd05ee88 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:17:54 +0530 Subject: [PATCH 037/127] Delete terraform/implementations/aws/infra/backend.tf Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/backend.tf | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 terraform/implementations/aws/infra/backend.tf diff --git a/terraform/implementations/aws/infra/backend.tf b/terraform/implementations/aws/infra/backend.tf deleted file mode 100644 index ff4cc9846..000000000 --- a/terraform/implementations/aws/infra/backend.tf +++ /dev/null @@ -1,5 +0,0 @@ -terraform { - backend "local" { - path = "profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate" - } -} From 48da6cb30980b1fd854e9be4562582858681f712 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:20:44 +0530 Subject: [PATCH 038/127] Update aws.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../infra/profiles/esignet-standalone/aws.tfvars | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index 85198c9a4..a7cfa4290 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -10,19 +10,19 @@ cluster_name = "" # eSignet's domain (ex: esignet.xyz.net) -cluster_env_domain = "" +cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = "6@gmail.com" +mosip_email_id = " 0 to From 924e37f17110f0ac1b843e16769019ca10b2db50 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 6 Aug 2026 17:25:17 +0530 Subject: [PATCH 039/127] fix: replace hardcoded P12 password and crypto encryption key with secretKeyRef MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeRabbit flagged MOSIP_P12_PASSWORD and CRYPTO_ENCRYPTION_KEY as hardcoded credentials (CWE-798), duplicated identically across all 4 esignet-standalone-2.0.0 plugin-values files. Replace with valueFrom.secretKeyRef pointing at a new shared esignet-go-crypto secret. - esignet-preinstall.sh (shared by all 4 esignet-go-* instances) now mints esignet-go-crypto in the captcha namespace from two new required GH Actions secrets (ESIGNET_P12_PASSWORD, ESIGNET_CRYPTO_ENCRYPTION_KEY) and copies it into each instance's namespace, following the same pattern already used for captcha secrets - helmsman_esignet.yml: wire the two new secrets through env passthrough, masking, and validation (required only when profile == esignet-standalone-2.0.0) - Deployment guide updated with the two new secrets Existing values are preserved (not rotated) to avoid breaking anything tied to the current P12 keystore files — the secret material now lives only in GitHub Environment secrets, never committed to the repo. Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 22 +++++++++++++++++++ .../esignet-preinstall.sh | 14 ++++++++++++ .../esignet-mosipid1-plugin-values-2-0-0.yaml | 10 +++++++-- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 10 +++++++-- .../esignet-plugin-values-2-0-0.yaml | 10 +++++++-- .../esignet-sunbird-plugin-values-2-0-0.yaml | 10 +++++++-- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 2 ++ 7 files changed, 70 insertions(+), 8 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 170fb368f..a7eb3a817 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -143,6 +143,10 @@ jobs: MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }} + # eSignet-Go (esignet-standalone-2.0.0 profile only) P12 keystore password + + # crypto encryption key — shared across all 4 esignet-go-* instances + ESIGNET_P12_PASSWORD: ${{ secrets.ESIGNET_P12_PASSWORD }} + ESIGNET_CRYPTO_ENCRYPTION_KEY: ${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }} # Spring config label per namespace — controls which Git branch/tag the config-server uses # Set as Environment Variables in Repository → Settings → Environments → → Variables # If unset, hooks default to 'develop' @@ -209,6 +213,8 @@ jobs: echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_P12_PASSWORD }}" + echo "::add-mask::${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }}" - name: Setup kubectl and kubeconfig env: @@ -418,6 +424,19 @@ jobs: else echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" fi + + if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then + echo "--- Validating esignet-standalone-2.0.0 P12/crypto secrets ---" + for var in ESIGNET_P12_PASSWORD ESIGNET_CRYPTO_ENCRYPTION_KEY; do + val="${!var:-}" + if [ -z "$val" ]; then + echo "❌ $var secret is not configured (required for esignet-standalone-2.0.0)" + MISSING_SECRETS=1 + else + echo "✅ $var is configured" + fi + done + fi fi if [ "$MISSING_SECRETS" -eq 1 ]; then @@ -440,6 +459,9 @@ jobs: echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" fi + if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then + echo " - ESIGNET_P12_PASSWORD / ESIGNET_CRYPTO_ENCRYPTION_KEY" + fi fi exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index eec0071d5..3885cc0c0 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -80,4 +80,18 @@ $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" echo "Copying keycloak-client-secrets secret from $KEYCLOAK_NS" $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" +# --- Step 5: Shared eSignet P12 password + crypto encryption key --- +ESIGNET_P12_PASSWORD_VAL="${ESIGNET_P12_PASSWORD:?ERROR: ESIGNET_P12_PASSWORD must be set}" +ESIGNET_CRYPTO_KEY_VAL="${ESIGNET_CRYPTO_ENCRYPTION_KEY:?ERROR: ESIGNET_CRYPTO_ENCRYPTION_KEY must be set}" +CRYPTO_HUB_NS="captcha" + +echo "Creating esignet-go-crypto secret in $CRYPTO_HUB_NS namespace" +kubectl -n "$CRYPTO_HUB_NS" create secret generic esignet-go-crypto \ + --from-literal=p12-password="$ESIGNET_P12_PASSWORD_VAL" \ + --from-literal=crypto-encryption-key="$ESIGNET_CRYPTO_KEY_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying esignet-go-crypto secret from $CRYPTO_HUB_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-go-crypto "$CRYPTO_HUB_NS" "$ESIGNET_NS" + echo "eSignet pre-install completed." diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 697de99b0..e89a64b79 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -64,11 +64,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/mosipid1.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 96e42db3e..f915ee073 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -64,11 +64,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/mosipid2.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index 6f53b8731..bb20b7512 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -78,11 +78,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/mock.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index 54f52350c..1b30dd47a 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -66,11 +66,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/sunbird.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 4340b2245..1c554a9f1 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -174,6 +174,8 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | | `ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-sunbird` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-sunbird` namespace | +| `ESIGNET_P12_PASSWORD` | P12 keystore password, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | +| `ESIGNET_CRYPTO_ENCRYPTION_KEY` | Crypto encryption key, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | | `MOSIPID1_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID1 remote MOSIP environment | | `MOSIPID2_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | | `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID1 remote MOSIP environment | From f160f6566f296819724168e9929059bb3af87010 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 7 Aug 2026 12:34:03 +0530 Subject: [PATCH 040/127] fix: switch esignet-go-* keymanager config to match upstream PKCS11 integration, PKCS12 for mosipid1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follows mosip/esignet#2331 (Keymanager integration changes), which removed MOSIP_P12_PASSWORD/CRYPTO_ENCRYPTION_KEY from the chart entirely in favor of KEYMANAGER_* config: - mock/mosipid2/sunbird: KEYMANAGER_KEYSTORE_TYPE PKCS11, using each instance's existing esignet-softhsm-go-* secret for KEYMANAGER_PKCS11_PIN; module path corrected to the real /usr/lib/softhsm/libsofthsm2.so from the now-merged upstream chart (was a placeholder) - mosipid1: KEYMANAGER_KEYSTORE_TYPE PKCS12 instead, using the extraVolumes/extraVolumeMounts capability added in mosip/esignet#2333. esignet-mosipid1-preinstall.sh now generates a throwaway self-signed PKCS12 keystore (create-if-missing, so it stays stable across redeploys) in secret esignet-keystore-go-mosipid1, bulk-imported via extraEnvVarsSecret for KEYMANAGER_PKCS12_PASSWORD and mounted at /home/mosip/keys/secret for KEYMANAGER_PKCS12_FILE_PATH - Removed the now-unused ESIGNET_P12_PASSWORD/ESIGNET_CRYPTO_ENCRYPTION_KEY GitHub secrets wiring from helmsman_esignet.yml and the deployment guide — no GH secrets needed for either keystore approach anymore https://github.com/mosip/esignet/issues/2333 Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 22 ---------------- .../esignet-mosipid1-preinstall.sh | 23 +++++++++++++++++ .../esignet-preinstall.sh | 14 ----------- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 25 +++++++++++-------- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 23 +++++++++-------- .../esignet-plugin-values-2-0-0.yaml | 23 +++++++++-------- .../esignet-sunbird-plugin-values-2-0-0.yaml | 23 +++++++++-------- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 2 -- 8 files changed, 76 insertions(+), 79 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index a7eb3a817..170fb368f 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -143,10 +143,6 @@ jobs: MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }} - # eSignet-Go (esignet-standalone-2.0.0 profile only) P12 keystore password + - # crypto encryption key — shared across all 4 esignet-go-* instances - ESIGNET_P12_PASSWORD: ${{ secrets.ESIGNET_P12_PASSWORD }} - ESIGNET_CRYPTO_ENCRYPTION_KEY: ${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }} # Spring config label per namespace — controls which Git branch/tag the config-server uses # Set as Environment Variables in Repository → Settings → Environments → → Variables # If unset, hooks default to 'develop' @@ -213,8 +209,6 @@ jobs: echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_P12_PASSWORD }}" - echo "::add-mask::${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }}" - name: Setup kubectl and kubeconfig env: @@ -424,19 +418,6 @@ jobs: else echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" fi - - if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then - echo "--- Validating esignet-standalone-2.0.0 P12/crypto secrets ---" - for var in ESIGNET_P12_PASSWORD ESIGNET_CRYPTO_ENCRYPTION_KEY; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet-standalone-2.0.0)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - fi fi if [ "$MISSING_SECRETS" -eq 1 ]; then @@ -459,9 +440,6 @@ jobs: echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" fi - if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then - echo " - ESIGNET_P12_PASSWORD / ESIGNET_CRYPTO_ENCRYPTION_KEY" - fi fi exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh index e0d5ccbc1..ce97e8240 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh @@ -44,6 +44,29 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi +# Create esignet-keystore-go-mosipid1 (PKCS12 keystore for KEYMANAGER_KEYSTORE_TYPE: PKCS12) — +# a throwaway self-signed cert generated once and reused across redeploys. Never regenerate an +# existing keystore: KEYMANAGER_PKCS12_PASSWORD/mosipid1.pfx must stay stable, or anything +# encrypted with the old keystore becomes unreadable. +if ! kubectl -n "$ESIGNET_NS" get secret esignet-keystore-go-mosipid1 &>/dev/null; then + echo "Generating dummy PKCS12 keystore for mosipid1" + DUMMY_P12_PASSWORD="$(openssl rand -hex 16)" + TMP_KEY="$(mktemp)" + TMP_CERT="$(mktemp)" + TMP_P12="$(mktemp)" + openssl req -x509 -newkey rsa:2048 -keyout "$TMP_KEY" -out "$TMP_CERT" \ + -days 3650 -nodes -subj "/CN=esignet-go-mosipid1-dummy" 2>/dev/null + openssl pkcs12 -export -out "$TMP_P12" -inkey "$TMP_KEY" -in "$TMP_CERT" \ + -passout "pass:${DUMMY_P12_PASSWORD}" + kubectl -n "$ESIGNET_NS" create secret generic esignet-keystore-go-mosipid1 \ + --from-literal=KEYMANAGER_PKCS12_PASSWORD="$DUMMY_P12_PASSWORD" \ + --from-file=mosipid1.pfx="$TMP_P12" + rm -f "$TMP_KEY" "$TMP_CERT" "$TMP_P12" + echo "esignet-keystore-go-mosipid1 secret created in $ESIGNET_NS" +else + echo "esignet-keystore-go-mosipid1 already exists — reusing existing keystore" +fi + echo "Creating esignet-captcha-go-mosipid1 secret in $CAPTCHA_NS namespace" kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid1 \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index 3885cc0c0..eec0071d5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -80,18 +80,4 @@ $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" echo "Copying keycloak-client-secrets secret from $KEYCLOAK_NS" $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" -# --- Step 5: Shared eSignet P12 password + crypto encryption key --- -ESIGNET_P12_PASSWORD_VAL="${ESIGNET_P12_PASSWORD:?ERROR: ESIGNET_P12_PASSWORD must be set}" -ESIGNET_CRYPTO_KEY_VAL="${ESIGNET_CRYPTO_ENCRYPTION_KEY:?ERROR: ESIGNET_CRYPTO_ENCRYPTION_KEY must be set}" -CRYPTO_HUB_NS="captcha" - -echo "Creating esignet-go-crypto secret in $CRYPTO_HUB_NS namespace" -kubectl -n "$CRYPTO_HUB_NS" create secret generic esignet-go-crypto \ - --from-literal=p12-password="$ESIGNET_P12_PASSWORD_VAL" \ - --from-literal=crypto-encryption-key="$ESIGNET_CRYPTO_KEY_VAL" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying esignet-go-crypto secret from $CRYPTO_HUB_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-go-crypto "$CRYPTO_HUB_NS" "$ESIGNET_NS" - echo "eSignet pre-install completed." diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index e89a64b79..409283736 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -61,20 +61,14 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS12 + - name: KEYMANAGER_PKCS12_FILE_PATH value: /home/mosip/keys/secret/mosipid1.pfx - - name: MOSIP_P12_PASSWORD - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: p12-password - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH @@ -87,6 +81,15 @@ extraEnvVars: value: decl-layout-1 - name: DEFAULT_AUTH_FLOW_ID value: decl-mosip-otp-flow-1 +extraEnvVarsSecret: + - esignet-keystore-go-mosipid1 +extraVolumes: + - name: esignet-keystore-go-mosipid1 + secret: + secretName: esignet-keystore-go-mosipid1 +extraVolumeMounts: + - name: esignet-keystore-go-mosipid1 + mountPath: /home/mosip/keys/secret extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" value: "esignetgomosipid1" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index f915ee073..7c4890e12 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -61,20 +61,23 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/mosipid2.pfx - - name: MOSIP_P12_PASSWORD + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS11 + - name: KEYMANAGER_PKCS11_MODULE_PATH + value: /usr/lib/softhsm/libsofthsm2.so + - name: KEYMANAGER_PKCS11_TOKEN_LABEL + value: esignet + - name: KEYMANAGER_PKCS11_SLOT_ID + value: "0" + - name: KEYMANAGER_PKCS11_PIN valueFrom: secretKeyRef: - name: esignet-go-crypto - key: p12-password + name: esignet-softhsm-go-mosipid2 + key: security-pin - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index bb20b7512..83c8dbd6c 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -75,20 +75,23 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/mock.pfx - - name: MOSIP_P12_PASSWORD + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS11 + - name: KEYMANAGER_PKCS11_MODULE_PATH + value: /usr/lib/softhsm/libsofthsm2.so + - name: KEYMANAGER_PKCS11_TOKEN_LABEL + value: esignet + - name: KEYMANAGER_PKCS11_SLOT_ID + value: "0" + - name: KEYMANAGER_PKCS11_PIN valueFrom: secretKeyRef: - name: esignet-go-crypto - key: p12-password + name: esignet-softhsm-go + key: security-pin - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index 1b30dd47a..80ec0bb63 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -63,20 +63,23 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/sunbird.pfx - - name: MOSIP_P12_PASSWORD + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS11 + - name: KEYMANAGER_PKCS11_MODULE_PATH + value: /usr/lib/softhsm/libsofthsm2.so + - name: KEYMANAGER_PKCS11_TOKEN_LABEL + value: esignet + - name: KEYMANAGER_PKCS11_SLOT_ID + value: "0" + - name: KEYMANAGER_PKCS11_PIN valueFrom: secretKeyRef: - name: esignet-go-crypto - key: p12-password + name: esignet-softhsm-go-sunbird + key: security-pin - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 1c554a9f1..4340b2245 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -174,8 +174,6 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | | `ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-sunbird` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-sunbird` namespace | -| `ESIGNET_P12_PASSWORD` | P12 keystore password, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | -| `ESIGNET_CRYPTO_ENCRYPTION_KEY` | Crypto encryption key, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | | `MOSIPID1_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID1 remote MOSIP environment | | `MOSIPID2_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | | `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID1 remote MOSIP environment | From 226de62cd5fadde359c8b609597ee0ac246be825 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 7 Aug 2026 13:22:55 +0530 Subject: [PATCH 041/127] fix: use fixed localtest password for mosipid1 dummy PKCS12 keystore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use a fixed known value instead of a randomly generated one — this password only protects a throwaway self-signed dummy keystore generated by this hook, not real production key material, so a shared known value is acceptable here. https://github.com/mosip/esignet/issues/2333 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh index ce97e8240..cd5501eaf 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh @@ -50,7 +50,7 @@ fi # encrypted with the old keystore becomes unreadable. if ! kubectl -n "$ESIGNET_NS" get secret esignet-keystore-go-mosipid1 &>/dev/null; then echo "Generating dummy PKCS12 keystore for mosipid1" - DUMMY_P12_PASSWORD="$(openssl rand -hex 16)" + DUMMY_P12_PASSWORD="localtest" TMP_KEY="$(mktemp)" TMP_CERT="$(mktemp)" TMP_P12="$(mktemp)" From 63cf707c2f86bcc2cbbeab01f4bf55894c2df66c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 7 Aug 2026 17:10:37 +0530 Subject: [PATCH 042/127] fix: resolve CodeRabbit review findings on esignet-standalone-2.0.0 Correctness/security fixes: - helmsman_esignet.yml: use env.PROFILE (not the empty push-event input) in the MOSIP DSF check condition - helmsman_esignet.yml, helmsman_testrigs.yml: enforce mosipid1_domain_name/ mosipid2_domain_name as required instead of silently accepting empty values - helmsman_testrigs.yml: bind workflow inputs to env: and reference them as shell variables instead of interpolating ${{ }} directly into the script body (GitHub Actions script injection hardening) - esignet-misp-onboarder-postinstall.sh: always restore Istio injection before returning, exit nonzero on job failure instead of continuing to restart dependent workloads, stop masking rollout-status failures - esignet-misp-onboarder-preinstall.sh: add an EXIT trap to restore Istio injection if the hook fails partway, so a failed preinstall doesn't leave the namespace permanently without sidecar injection - kernel-preinstall.sh: validate MOSIP_API_HOST/MOSIP_API_INTERNAL_HOST before creating the domain-config configmap instead of silently defaulting to empty - softhsm-esignet-postinstall.sh: fix the copied configmap name (esignet-softhsm-share -> esignet-softhsm-go-share, matching what the mosip/softhsm chart actually creates) and stop suppressing copy failures - signup-service-preinstall.sh: restart the captcha deployment when the signup-go secret is updated on an existing deployment, not just on first creation, so key/secret rotations actually take effect - trigger-test-jobs-esignet.sh: distinguish genuine NotFound from other kubectl failures (RBAC, credentials, API errors) in the CronJob existence check, CronJob list, and Job status polling; separate local declarations from command-substitution assignments so exit codes are captured correctly; propagate signup/signup-go job failures into OVERALL_SUCCESS instead of discarding them - 4x apitestrig-esignet-*-setup.sh: create the s3-esignet-*-apitestrig and apitestrig-esignet-*-apitestrig secrets referenced by extraEnvVarsSecret, which nothing was creating before - esignet-mosipid1/2-plugin-values-2-0-0.yaml: LOGGING_LEVEL DEBUG -> INFO Documentation/consistency fixes: - Replace stale "eSignet 1.7.1" banners/headers with "eSignet Standalone 2.0.0" across hook scripts, and correct documented env var defaults to match code - esignet-dsf.yaml, testrigs-dsf.yaml: correct stale v1.7.1 references in comments and a commented-out postInstall path - captcha-postinstall.sh: fix header docs to match the actual env var names and default namespace - aws.tfvars: close an unclosed placeholder - Remove stray trailing blank lines / extra blank lines in two values files - ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: fix markdownlint MD028/MD029/MD031 violations, correct the Steps 2/4 profile-acceptance note, remove unconditional signup CronJob verification commands (Step 3 isn't ready for either profile), and extend the MOSIP-ID2 allowed-domain-uris example to cover shared MOSIP-ID2 environments Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 11 ++- .github/workflows/helmsman_testrigs.yml | 23 +++++- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 8 +- .../testrigs-dsf.yaml | 14 ++-- .../apitestrig-esignet-mosipid1-setup.sh | 22 ++++-- .../apitestrig-esignet-mosipid2-setup.sh | 22 ++++-- .../apitestrig-esignet-setup.sh | 22 ++++-- .../apitestrig-esignet-sunbird-setup.sh | 22 ++++-- .../captcha-postinstall.sh | 6 +- .../esignet-misp-onboarder-postinstall.sh | 20 +++-- .../esignet-misp-onboarder-preinstall.sh | 8 ++ .../kernel-preinstall.sh | 9 +++ .../mock-identity-init-db.sh | 6 +- .../mock-identity-system-preinstall.sh | 8 +- ...lying-party-service-mosipid1-preinstall.sh | 2 +- ...lying-party-service-mosipid2-preinstall.sh | 2 +- .../mock-relying-party-service-preinstall.sh | 4 +- ...elying-party-service-sunbird-preinstall.sh | 2 +- ...ck-relying-party-ui-mosipid1-preinstall.sh | 4 +- ...ck-relying-party-ui-mosipid2-preinstall.sh | 4 +- .../mock-relying-party-ui-preinstall.sh | 4 +- ...ock-relying-party-ui-sunbird-preinstall.sh | 4 +- .../notifier-postinstall.sh | 4 +- .../oidc-ui-mosipid1-preinstall.sh | 2 +- .../signup-service-preinstall.sh | 4 +- .../softhsm-esignet-postinstall.sh | 10 +-- .../trigger-test-jobs-esignet.sh | 76 +++++++++++++++---- .../uitestrig-signup-setup.sh | 6 +- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 2 +- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 3 +- .../esignet-plugin-values-2-0-0.yaml | 1 - docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 35 +++++---- .../profiles/esignet-standalone/aws.tfvars | 2 +- 33 files changed, 257 insertions(+), 115 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 170fb368f..d09e8d959 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -94,6 +94,15 @@ jobs: if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" + if [ -z "$MOSIPID1_DOMAIN" ]; then + echo "❌ mosipid1_domain_name is required for standalone profiles" + exit 1 + fi + if [ "${{ github.event.inputs.enable_mosipid2 }}" = "true" ] && + [ -z "$MOSIPID2_DOMAIN" ]; then + echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" + exit 1 + fi echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" MOSIPID1_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }}" @@ -326,7 +335,7 @@ jobs: kubectl cluster-info - name: Check if mosip-dsf label is completed - if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(github.event.inputs.profile, 'esignet-standalone') }} + if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(env.PROFILE, 'esignet-standalone') }} run: | STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.mosip-dsf}' 2>/dev/null || echo "") if [[ "$STATUS" != "completed" ]]; then diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 8a2c5395b..1b19de8ff 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -73,6 +73,12 @@ jobs: name: ${{ github.ref_name }} steps: - name: Validate required variables + env: + IN_MOSIPID1_DOMAIN: ${{ github.event.inputs.mosipid1_domain_name }} + IN_MOSIPID2_DOMAIN: ${{ github.event.inputs.mosipid2_domain_name }} + VAR_MOSIPID1_DOMAIN: ${{ vars.MOSIPID1_DOMAIN_NAME }} + VAR_MOSIPID2_DOMAIN: ${{ vars.MOSIPID2_DOMAIN_NAME }} + IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -100,13 +106,22 @@ jobs: # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. # Push events always target the esignet profile (path filter); dispatch uses explicit profile input. if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then - MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" - MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" + MOSIPID1_DOMAIN="${IN_MOSIPID1_DOMAIN:-$VAR_MOSIPID1_DOMAIN}" + MOSIPID2_DOMAIN="${IN_MOSIPID2_DOMAIN:-$VAR_MOSIPID2_DOMAIN}" + if [ -z "$MOSIPID1_DOMAIN" ]; then + echo "❌ mosipid1_domain_name is required for standalone profiles" + exit 1 + fi + if [ "$IN_ENABLE_MOSIPID2" = "true" ] && + [ -z "$MOSIPID2_DOMAIN" ]; then + echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" + exit 1 + fi echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" else - MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" - MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" + MOSIPID1_PROVIDED="$IN_MOSIPID1_DOMAIN" + MOSIPID2_PROVIDED="$IN_MOSIPID2_DOMAIN" if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" fi diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 9ce3a8826..0deca2876 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -1,19 +1,19 @@ # ============================================================================= # eSignet Profile - eSignet Services DSF (Desired State File) # ============================================================================= -# This DSF deploys eSignet v1.7.1 services for the standalone eSignet profile. +# This DSF deploys eSignet 2.0.0 (Go) services for the standalone eSignet profile. # # Components (in priority order): # 1. Keycloak Init (eSignet-specific clients and roles) -# 2. eSignet service v1.7.1 -# 3. OIDC UI v1.7.1 +# 2. eSignet service 2.0.0-develop (Go) +# 3. OIDC UI 2.0.0-develop (Go) # 4. Mock Identity System (optional, disabled by default) # 5. Mock Relying Party Service (optional) # 6. Mock Relying Party UI (optional) # 7. Partner Onboarder (eSignet + Resident OIDC) # 8. Demo OIDC Partner Onboarder # -# Based on eSignet v1.7.1 deploy scripts: +# Based on eSignet 2.0.0 deploy scripts: # - install-esignet.sh # - initialise-prereq.sh (keycloak-init) # ============================================================================= diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index f243acad9..b48741524 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -8,12 +8,12 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): -# esignet-apitestrig → esignet ns -# esignet-mosipid1-apitestrig → esignet-mosipid1 ns -# esignet-mosipid2-apitestrig → esignet-mosipid2 ns -# esignet-sunbird-apitestrig → esignet-sunbird ns -# esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) -# signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) +# esignet-apitestrig-go → esignet-go-mock ns +# esignet-go-mosipid1-apitestrig → esignet-go-mosipid1 ns +# esignet-go-mosipid2-apitestrig → esignet-go-mosipid2 ns +# esignet-go-sunbird-apitestrig → esignet-go-sunbird ns +# esignet-signup-apitestrig-go → signup-go ns (disabled — enable if signup deployed) +# signup-uitestrig-go → signup-uitestrig-go (disabled — enable if signup deployed) namespaces: esignet-go-mosipid1: protected: false @@ -212,7 +212,7 @@ apps: priority: -2 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh" - # postInstall: "$WORKDIR/hooks/esignet-standalone/trigger-test-jobs-esignet.sh" + # postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh" # --------------------------------------------------------------------------- # Signup API Test Rig — disabled by default diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh index adbdcadfb..14b70b216 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release. +# Prepares the esignet-mosipid1 namespace for the esignet-go-mosipid1-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-mosipid1-apitestrig / apitestrig-esignet-mosipid1-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-mosipid1 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-mosipid1-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-mosipid1-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-mosipid1-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid1-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh index bb5f2d9e2..072faec92 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release. +# Prepares the esignet-mosipid2 namespace for the esignet-go-mosipid2-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-mosipid2-apitestrig / apitestrig-esignet-mosipid2-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-mosipid2 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-mosipid2-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-mosipid2-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-mosipid2-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid2-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh index de0fb532e..ebd79e8e9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mock namespace for the esignet-apitestrig release. +# Prepares the esignet-mock namespace for the esignet-apitestrig-go release. # keycloak-host and keycloak-client-secrets are already present in esignet-mock ns -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-apitestrig / apitestrig-esignet-apitestrig secrets referenced +# by extraEnvVarsSecret are created here (chart doesn't create them itself); stale +# testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-mock COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh index 1a58942ea..d7adbcca9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-sunbird namespace for the esignet-sunbird-apitestrig release. +# Prepares the esignet-sunbird namespace for the esignet-go-sunbird-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-sunbird -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-sunbird-apitestrig / apitestrig-esignet-sunbird-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-sunbird COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-sunbird-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-sunbird-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-sunbird-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-sunbird-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh index 938217c8c..60ef72d59 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh @@ -7,9 +7,9 @@ # with the secret key environment variable. # # Environment Variables: -# CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) -# CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) -# ESIGNET_NS - eSignet namespace (default: esignet) +# ESIGNET_CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) +# ESIGNET_CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) +# ESIGNET_NS - eSignet namespace (default: esignet-go-mock) # ============================================================================= set -euo pipefail diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index bfeb5c619..f26e8ed56 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -18,23 +18,22 @@ JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ -l app.kubernetes.io/instance=esignet-misp-onboarder-go \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") -if [ "$JOB_STATUS" = "1" ]; then - echo "eSignet MISP partner onboarding completed successfully." -else +# Always restore namespace injection before returning from this hook. +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite +echo "Istio injection re-enabled on namespace $ESIGNET_NS." + +if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then echo "WARNING: onboarding job may not have completed. Check logs:" kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder-go --tail=30 2>/dev/null || true + exit 1 fi - -# Re-enable Istio sidecar injection now that the Job has completed -kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite -echo "Istio injection re-enabled on namespace $ESIGNET_NS." +echo "eSignet MISP partner onboarding completed successfully." # Restart config-server first so it reloads the MISP key from the secret, # then restart esignet so it fetches the updated config from config-server. if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server-go &>/dev/null; then kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server-go - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s || \ - echo "WARNING: esignet-config-server-go rollout did not complete within timeout." >&2 + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s echo "esignet-config-server-go restarted." else echo "esignet-config-server-go deployment not found — skipping restart." @@ -42,8 +41,7 @@ fi if kubectl -n "$ESIGNET_NS" get deployment esignet-go-mock &>/dev/null; then kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-go-mock - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s || \ - echo "WARNING: esignet rollout did not complete within timeout." >&2 + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s echo "esignet deployment restarted." else echo "esignet deployment not found — skipping restart." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh index 72baca851..e8dc9d7e8 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -26,6 +26,14 @@ kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply kubectl label namespace "$ESIGNET_NS" istio-injection=disabled --overwrite echo "Istio injection disabled on namespace $ESIGNET_NS." +restore_istio_injection_on_failure() { + local status=$? + if [ "$status" -ne 0 ]; then + kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite || true + fi +} +trap restore_istio_injection_on_failure EXIT + # Delete stale MISP onboarder artifacts from any previous run kubectl -n "$ESIGNET_NS" delete configmap esignet-onboarder-config --ignore-not-found=true kubectl -n "$ESIGNET_NS" delete secret esignet-onboarder-secrets --ignore-not-found=true diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh index 5651ce2b5..b4f4546ab 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh @@ -20,6 +20,15 @@ API_HOST="${MOSIP_API_HOST:-}" API_INTERNAL_HOST="${MOSIP_API_INTERNAL_HOST:-}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +if [ -z "$API_HOST" ]; then + echo "ERROR: MOSIP_API_HOST must be set" >&2 + exit 1 +fi +if [ -z "$API_INTERNAL_HOST" ]; then + echo "ERROR: MOSIP_API_INTERNAL_HOST must be set" >&2 + exit 1 +fi + echo "================================================" echo "eSignet 1.7.1 - Kernel Pre-install" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh index 9d22608cd..8f006956d 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh @@ -1,13 +1,13 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Identity System DB Init Pre-install +# eSignet Standalone 2.0.0 - Mock Identity System DB Init Pre-install # ============================================================================= # Based on: esignet-mock-services/deploy/postgres/init_db.sh # Ensures postgres-postgresql secret is present in the esignet namespace # before postgres-init-mock-identity helm chart runs DB initialization. # # Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet) +# ESIGNET_NS - eSignet namespace (default: esignet-go-mock) # ============================================================================= set -euo pipefail @@ -16,7 +16,7 @@ POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Mock Identity DB Init Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Identity DB Init Pre-install" echo "================================================" # --- Step 1: Ensure esignet namespace exists with istio --- diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh index da1b91802..4d51968bf 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Identity System Pre-install +# eSignet Standalone 2.0.0 - Mock Identity System Pre-install # ============================================================================= # Prepares esignet namespace for mock identity system deployment: # - Copies softhsm-mock-identity-system secret from softhsm ns @@ -8,8 +8,8 @@ # - Verifies softhsm-mock-identity-system-go-share ConfigMap is present # # Environment Variables: -# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem) -# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser) +# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem_go) +# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser_go) # MOCKID_DB_PORT - Postgres port (default: 5432) # ============================================================================= set -euo pipefail @@ -22,7 +22,7 @@ MOCKID_DB_PORT="${MOCKID_DB_PORT:-5432}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Mock Identity System Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Identity System Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh index 1847d2e5a..78db8d94c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID1 Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh index 069f92439..e6e8f3496 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID2 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID2 Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh index 45b51adcd..f2736d682 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install # ============================================================================= # Creates K8s secrets for mock relying party private keys from GitHub Actions # environment secrets, then verifies the esignet service is running. @@ -25,7 +25,7 @@ cleanup_temp_files() { trap cleanup_temp_files EXIT INT TERM echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party Service Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh index 7cb2fcbb6..74bc76ee2 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service Sunbird Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service Sunbird Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh index dd6165071..eccf10272 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install # ============================================================================= # Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service # is available in the esignet-mosipid1 namespace before UI deployment. @@ -10,7 +10,7 @@ set -euo pipefail ESIGNET_NS="esignet-go-mosipid1" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh index 3734187c8..3c65bbbcc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install # ============================================================================= # Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service # is available in the esignet-mosipid2 namespace before UI deployment. @@ -10,7 +10,7 @@ set -euo pipefail ESIGNET_NS="esignet-go-mosipid2" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh index 1340a045f..220b444ae 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh @@ -1,13 +1,13 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install # ============================================================================= # Prepares for mock relying party UI deployment. # ============================================================================= set -euo pipefail echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install" echo "================================================" # Ensure esignet namespace exists diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh index e1c066e06..9d37c849f 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install # ============================================================================= # Ensures esignet-sunbird namespace exists and verifies mock-relying-party-service # is available in the esignet-sunbird namespace before UI deployment. @@ -10,7 +10,7 @@ set -euo pipefail ESIGNET_NS="esignet-go-sunbird" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh index 8277b1a8f..5bf32602a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Notifier Post-install +# eSignet Standalone 2.0.0 - Notifier Post-install # ============================================================================= # Based on: esignet-signup/deploy/kernel/install.sh # Patches notifier deployment with SMS number length env vars after install. @@ -10,7 +10,7 @@ set -euo pipefail KERNEL_NS="kernel-go" echo "================================================" -echo "eSignet 1.7.1 - Notifier Post-install" +echo "eSignet Standalone 2.0.0 - Notifier Post-install" echo "================================================" # Source: deploy/kernel/install.sh - kubectl set env deployment/notifier diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh index fb19d5533..57aa055fa 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - OIDC UI MOSIPID1 Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. # ============================================================================= diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh index 84be8071d..1b95fc1e7 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh @@ -64,7 +64,9 @@ if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n captcha captcha --type='json' \ -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO", "valueFrom": {"secretKeyRef": {"name": "signup-captcha-go", "key": "signup-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO already exists." + echo "Restarting captcha to load the updated signup-go secret." + kubectl -n captcha rollout restart deployment/captcha + kubectl -n captcha rollout status deployment/captcha --timeout=480s fi # --- Step 5: Create signup-keystore secrets --- diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh index 2d02ce0cd..2818214bc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh @@ -25,14 +25,12 @@ echo "Waiting for SoftHSM pod to be ready..." kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm-go --timeout=480s || \ { echo "ERROR: SoftHSM pod not ready after timeout" >&2; exit 1; } -# --- Step 2: Copy esignet-softhsm-share configmap to esignet namespace --- -echo "Copying esignet-softhsm-share configmap to $ESIGNET_NS namespace" -$COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ - echo "WARNING: esignet-softhsm-share configmap not found in $SOFTHSM_NS" +# --- Step 2: Copy esignet-softhsm-go-share configmap to esignet namespace --- +echo "Copying esignet-softhsm-go-share configmap to $ESIGNET_NS namespace" +$COPY_UTIL configmap esignet-softhsm-go-share "$SOFTHSM_NS" "$ESIGNET_NS" # --- Step 3: Copy esignet-softhsm secret to esignet namespace --- echo "Copying esignet-softhsm-go secret to $ESIGNET_NS namespace" -$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ - echo "WARNING: esignet-softhsm-go secret not found in $SOFTHSM_NS" +$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM eSignet post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh index 58088c891..99884df6b 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh @@ -1,11 +1,11 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Trigger Testrig CronJobs +# eSignet Standalone 2.0.0 - Trigger Testrig CronJobs # ============================================================================= # Immediately triggers testrig CronJobs after deployment: -# apitestrig → esignet-mock ns (cronjob-apitestrig-esignet-mock) -# signup-apitestrig → signup ns (if deployed) -# signup-uitestrig → signup-uitestrig ns (if deployed) +# apitestrig → esignet-go-mock ns +# signup-apitestrig → signup-go ns (if deployed) +# signup-uitestrig → signup-uitestrig-go ns (if deployed) # ============================================================================= set -euo pipefail @@ -13,12 +13,35 @@ CONTINUE_ON_FAILURE="${CONTINUE_ON_FAILURE:-true}" JOB_TIMEOUT="${JOB_TIMEOUT:-5400}" OVERALL_SUCCESS=true +# Runs `kubectl "$@"`, printing stdout on success. +# Returns 0 on success, 2 for a genuine NotFound (caller should treat the +# resource as absent), or 1 with the error printed to stderr for any other +# kubectl failure (RBAC, credentials, API errors) so real problems aren't +# silently swallowed alongside the expected "doesn't exist" case. +kubectl_get() { + local output rc=0 + output=$(kubectl "$@" 2>&1) || rc=$? + if [[ $rc -eq 0 ]]; then + printf '%s' "$output" + return 0 + fi + if echo "$output" | grep -q '(NotFound)'; then + return 2 + fi + echo "✗ kubectl $* failed: $output" >&2 + return 1 +} + trigger_and_wait() { local ns=$1 cronjob=$2 - if ! kubectl get cronjob -n "$ns" "$cronjob" &>/dev/null; then + local rc=0 + kubectl_get get cronjob -n "$ns" "$cronjob" -o name >/dev/null || rc=$? + if [[ $rc -eq 2 ]]; then echo "⏭ CronJob $cronjob not found in $ns — skipping" return 0 + elif [[ $rc -ne 0 ]]; then + return 1 fi local job_name="${cronjob}-manual-$(date +%s)" @@ -27,10 +50,29 @@ trigger_and_wait() { local elapsed=0 while [[ $elapsed -lt $JOB_TIMEOUT ]]; do - local complete=$(kubectl get job -n "$ns" "$job_name" \ - -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}' 2>/dev/null || echo "") - local failed=$(kubectl get job -n "$ns" "$job_name" \ - -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}' 2>/dev/null || echo "") + local complete failed + rc=0 + complete=$(kubectl_get get job -n "$ns" "$job_name" \ + -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo " ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..." + sleep 10 + elapsed=$((elapsed + 10)) + continue + elif [[ $rc -ne 0 ]]; then + return 1 + fi + rc=0 + failed=$(kubectl_get get job -n "$ns" "$job_name" \ + -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo " ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..." + sleep 10 + elapsed=$((elapsed + 10)) + continue + elif [[ $rc -ne 0 ]]; then + return 1 + fi [[ "$complete" == "True" ]] && { echo "✓ $job_name completed successfully"; return 0; } [[ "$failed" == "True" ]] && { echo "✗ $job_name failed" >&2 @@ -48,8 +90,14 @@ trigger_and_wait() { trigger_all_in_ns() { local ns=$1 - local cronjobs - cronjobs=$(kubectl get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "") + local cronjobs rc=0 + cronjobs=$(kubectl_get get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo "⏭ No CronJobs found in $ns — skipping" + return 0 + elif [[ $rc -ne 0 ]]; then + return 1 + fi if [[ -z "$cronjobs" ]]; then echo "⏭ No CronJobs found in $ns — skipping" return 0 @@ -60,7 +108,7 @@ trigger_all_in_ns() { } echo "================================================" -echo "eSignet 1.7.1 - Trigger Testrig CronJobs" +echo "eSignet Standalone 2.0.0 - Trigger Testrig CronJobs" echo "================================================" echo "=== eSignet API Testrig (esignet-go-mock ns) ===" @@ -76,10 +124,10 @@ echo "=== eSignet-Sunbird API Testrig (esignet-go-sunbird ns) ===" trigger_all_in_ns esignet-go-sunbird || OVERALL_SUCCESS=false echo "=== Signup API Testrig (signup-go ns, if deployed) ===" -trigger_all_in_ns signup-go || true +trigger_all_in_ns signup-go || OVERALL_SUCCESS=false echo "=== Signup UI Testrig (signup-uitestrig-go ns, if deployed) ===" -trigger_all_in_ns signup-uitestrig-go || true +trigger_all_in_ns signup-uitestrig-go || OVERALL_SUCCESS=false echo "" echo "=== Testrig Execution Summary ===" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh index c4f7ccf45..102ff6a9c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh @@ -1,8 +1,8 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Signup UI Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install Setup # ============================================================================= -# Prepares the signup-uitestrig namespace. +# Prepares the signup-uitestrig-go namespace. # Copies keycloak resources from keycloak ns, MinIO s3 secret from minio ns, # and postgres-postgresql from postgres ns. # Stale uitestrig CMs are deleted so the chart recreates them from set: values. @@ -13,7 +13,7 @@ NS=signup-uitestrig-go COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Signup UI Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install" echo "================================================" echo "Ensuring $NS namespace exists with Istio injection disabled" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 409283736..7a48edd8f 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -135,7 +135,7 @@ extraEnvVarsAdditional: 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG + value: INFO - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED value: "false" - name: MOSIP_ESIGNET_CAPTCHA_URL diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 7c4890e12..9e5695a8e 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -135,7 +135,7 @@ extraEnvVarsAdditional: 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG + value: INFO - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED value: "" - name: MOSIP_ESIGNET_CAPTCHA_URL @@ -145,4 +145,3 @@ extraEnvVarsAdditional: secretKeyRef: name: esignet-misp-onboarder-key key: mosip-esignet-misp-key - diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index 83c8dbd6c..b10407528 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -117,7 +117,6 @@ extraEnvVars: # prefix: /v1/esignet/ - # extraEnvVarsAdditional is a Helm list — this file REPLACES the base list on merge. # All required entries (captcha + plugin-specific) must be present together. diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 4340b2245..49bdb12ca 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -180,7 +180,7 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | > ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. - +> > **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0` > — there are no separate `_GO`-suffixed GitHub secrets. Internally, the 2.0.0 hooks create differently-named > Kubernetes secrets (e.g. `esignet-captcha-go`, `esignet-captcha-go-mosipid1`) and patch differently-named env @@ -236,9 +236,10 @@ Step 3 → Deploy Signup (helmsman_signup.yml) ⚠️ IN PROGR Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min profile: esignet-standalone or esignet-standalone-2.0.0 ``` -> Steps 2–4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy the -> Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both profiles -> share the same external infrastructure. +> Steps 2 and 4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy +> the Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both +> profiles share the same external infrastructure. Step 3's dropdown also lists `esignet-standalone-2.0.0`, +> but the step itself isn't usable yet for either profile — see the note below. --- @@ -356,9 +357,11 @@ Follow the full instructions in the root README: [Step 3ca: Observation Infrastr ![Deploy External Services - Helmsman](_images/helmsman-external-services.png) **How to know it succeeded:** Click into the running workflow. Wait for all jobs to show a green tick. Then run: + ```bash kubectl get pods -n postgres && kubectl get pods -n keycloak && kubectl get pods -n kafka ``` + All pods should show `Running` or `Completed`. --- @@ -390,6 +393,10 @@ All pods should show `Running` or `Completed`. > **Important:** Always tick `skip_mosip_dsf_check` for standalone eSignet — without it, the workflow waits for a `mosip-dsf=completed` namespace label that will never appear (there is no full MOSIP deployment in this mode), and the workflow will fail. +4. Click the green **`Run workflow`** button + +![Deploy eSignet - Helmsman](_images/esignet.png) + > **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml` > instead — it deploys the same 4 instances (main/mock, mosipid1, mosipid2, sunbird) plus their OIDC UIs and mock > relying party service, but into `-go`-suffixed namespaces (`esignet-go-mock`, `esignet-go-mosipid1`, @@ -398,13 +405,10 @@ All pods should show `Running` or `Completed`. > `esignet-standalone`. You can run both profiles side by side in the same cluster — Step 1 only needs to be run > once, with `profile: esignet-standalone`. -4. Click the green **`Run workflow`** button - -![Deploy eSignet - Helmsman](_images/esignet.png) - **How to know it succeeded:** For `esignet-standalone`: + ```bash kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird # If enable_mosipid2 was set to true: @@ -412,6 +416,7 @@ kubectl get pods -n esignet-mosipid2 ``` For `esignet-standalone-2.0.0`: + ```bash kubectl get pods -n esignet-go-mock && kubectl get pods -n esignet-go-mosipid1 && kubectl get pods -n esignet-go-sunbird # If enable_mosipid2 was set to true: @@ -469,21 +474,21 @@ All pods should show `Running`. **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created: For `esignet-standalone`: + ```bash kubectl get cronjobs -n esignet-mock kubectl get cronjobs -n esignet-mosipid1 kubectl get cronjobs -n esignet-mosipid2 kubectl get cronjobs -n esignet-sunbird -kubectl get cronjobs -n signup ``` For `esignet-standalone-2.0.0`: + ```bash kubectl get cronjobs -n esignet-go-mock kubectl get cronjobs -n esignet-go-mosipid1 kubectl get cronjobs -n esignet-go-mosipid2 kubectl get cronjobs -n esignet-go-sunbird -kubectl get cronjobs -n signup-go ``` --- @@ -564,11 +569,13 @@ Reference commit: [mosip/mosip-config@e8961a2](https://github.com/mosip/mosip-co The MOSIP Identity Authentication service restricts which domains can call its APIs. Edit `id-authentication-default.properties` in the MOSIP platform's `mosip-config` branch and add your eSignet standalone hostnames to `mosip.ida.allowed.domain.uris`: **For mosipid1 only:** + ```properties mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1. ``` **For both mosipid1 and mosipid2:** + ```properties mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-mosipid2. ``` @@ -577,11 +584,13 @@ Replace `` with your eSignet standalone base domain (e.g. `sandbox. > **`esignet-standalone-2.0.0` note:** Since `MOSIPID1_DOMAIN_NAME`/`MOSIPID2_DOMAIN_NAME` are shared between both > profiles (see [Section 0](#0-understanding-the-esignet-instances)), if you're running `esignet-mosipid1` (v1.7.1) -> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment, add **both** hostnames to -> `mosip.ida.allowed.domain.uris`: +> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment (and similarly for +> MOSIP-ID2), add **both** hostnames for each shared environment to `mosip.ida.allowed.domain.uris`: +> > ```properties -> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1. +> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1.,https://esignet-mosipid2.,https://esignet-go-mosipid2. > ``` +> > Otherwise, only add the hostname for whichever profile(s) you actually deployed. Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index a7cfa4290..98b68ff23 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -13,7 +13,7 @@ cluster_name = "" cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = " Date: Fri, 7 Aug 2026 17:50:36 +0530 Subject: [PATCH 043/127] fix: bind enable_mosipid2 to env in helmsman_esignet.yml, guard mosipid2 cronjob checks in docs - helmsman_esignet.yml: bind github.event.inputs.enable_mosipid2 to a step-level env var in the validate-inputs job's "Validate required variables" step instead of interpolating ${{ }} directly into the shell condition (same script-injection hardening pattern already applied to helmsman_testrigs.yml) - ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: make the esignet-mosipid2 / esignet-go-mosipid2 CronJob verification commands conditional on enable_mosipid2, matching the pattern already used for the pods-check section earlier in the guide Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 4 +++- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 6 ++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index d09e8d959..f2753edf1 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -71,6 +71,8 @@ jobs: name: ${{ github.ref_name }} steps: - name: Validate required variables + env: + IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -98,7 +100,7 @@ jobs: echo "❌ mosipid1_domain_name is required for standalone profiles" exit 1 fi - if [ "${{ github.event.inputs.enable_mosipid2 }}" = "true" ] && + if [ "$IN_ENABLE_MOSIPID2" = "true" ] && [ -z "$MOSIPID2_DOMAIN" ]; then echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" exit 1 diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 49bdb12ca..8d8e29d8d 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -478,8 +478,9 @@ For `esignet-standalone`: ```bash kubectl get cronjobs -n esignet-mock kubectl get cronjobs -n esignet-mosipid1 -kubectl get cronjobs -n esignet-mosipid2 kubectl get cronjobs -n esignet-sunbird +# If enable_mosipid2 was set to true: +kubectl get cronjobs -n esignet-mosipid2 ``` For `esignet-standalone-2.0.0`: @@ -487,8 +488,9 @@ For `esignet-standalone-2.0.0`: ```bash kubectl get cronjobs -n esignet-go-mock kubectl get cronjobs -n esignet-go-mosipid1 -kubectl get cronjobs -n esignet-go-mosipid2 kubectl get cronjobs -n esignet-go-sunbird +# If enable_mosipid2 was set to true: +kubectl get cronjobs -n esignet-go-mosipid2 ``` --- From 1f8713ac4793ac33e0254dda8c1269e17f0b1188 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Sat, 15 Aug 2026 14:30:47 +0530 Subject: [PATCH 044/127] fix: convert esignet-standalone-2.0.0 extraEnvVars/extraEnvVarsAdditional to maps Matches the chart-side list-to-map conversion (mosip/esignet#2380, mosip/esignet-mock-services#602): Helm deep-merges map keys across values layers but replaces lists wholesale. Converts all 6 profile override files (esignet base/sunbird/mosipid1/mosipid2 plugin values, mock-identity, mock-relying-party) from list to map format, preserving every entry including the Helmsman-escaped Handlebars template value in MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS (verified byte-identical via diff, and re-rendered against the real charts to confirm no index-keyed garbage and correct final output). Also updates a stale comment describing the old list-replace merge semantics. NOTE: requires the esignet/mock-identity-system/mock-relying-party chart PRs to be merged and republished before this is deployed - until then the charts still expect lists and this would break. Signed-off-by: bhumi46 --- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 103 ++++++--------- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 111 +++++++--------- .../esignet-plugin-values-2-0-0.yaml | 118 +++++++----------- .../esignet-sunbird-plugin-values-2-0-0.yaml | 83 +++++------- .../mock-identity-values-2-0-0.yaml | 24 ++-- .../mock-replying-party.yaml | 19 ++- 6 files changed, 176 insertions(+), 282 deletions(-) diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 7a48edd8f..af9553846 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -4,83 +4,72 @@ # Override full extraEnvVars to use namespace-specific softhsm secret name. extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL + KEYCLOAK_EXTERNAL_URL: valueFrom: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: REDIS_HOST + REDIS_HOST: valueFrom: configMapKeyRef: name: redis-config key: redis-host - - name: REDIS_PORT + REDIS_PORT: valueFrom: configMapKeyRef: name: redis-config key: redis-port - - name: REDIS_PASSWORD + REDIS_PASSWORD: valueFrom: secretKeyRef: name: redis key: redis-password - - name: DATABASE_HOST + DATABASE_HOST: valueFrom: configMapKeyRef: name: postgres-config key: database-host - - name: DATABASE_PORT + DATABASE_PORT: valueFrom: configMapKeyRef: name: postgres-config key: database-port - - name: DATABASE_NAME + DATABASE_NAME: valueFrom: configMapKeyRef: name: postgres-config key: database-name - - name: DATABASE_USERNAME + DATABASE_USERNAME: valueFrom: configMapKeyRef: name: postgres-config key: database-username - - name: DB_DBUSER_PASSWORD + DB_DBUSER_PASSWORD: valueFrom: secretKeyRef: name: db-common-secrets key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN + SOFTHSM_ESIGNET_SECURITY_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go-mosipid1 key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET + MOSIP_IDA_CLIENT_SECRET: valueFrom: secretKeyRef: name: keycloak-client-secrets-mosipid1 key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: KEYMANAGER_DB_SCHEMA - value: esignet - - name: KEYMANAGER_KEYSTORE_TYPE - value: PKCS12 - - name: KEYMANAGER_PKCS12_FILE_PATH - value: /home/mosip/keys/secret/mosipid1.pfx - - name: OIDC_UI_SCHEME - value: https - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 + AUTHN_PROVIDER: mosip + KEYMANAGER_DB_SCHEMA: esignet + KEYMANAGER_KEYSTORE_TYPE: PKCS12 + KEYMANAGER_PKCS12_FILE_PATH: /home/mosip/keys/secret/mosipid1.pfx + OIDC_UI_SCHEME: https + OIDC_UI_PORT: '443' + OIDC_UI_LOGIN_PATH: /signin + OIDC_UI_ERROR_PATH: /error + DEFAULT_THEME_ID: decl-theme-1 + DEFAULT_LAYOUT_ID: decl-layout-1 + DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 extraEnvVarsSecret: - esignet-keystore-go-mosipid1 extraVolumes: @@ -91,9 +80,8 @@ extraVolumeMounts: - name: esignet-keystore-go-mosipid1 mountPath: /home/mosip/keys/secret extraEnvVarsAdditional: - - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetgomosipid1" - - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" + "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME": "esignetgomosipid1" + "MOSIP_ESIGNET_CAPTCHA_SITE-KEY": valueFrom: secretKeyRef: name: esignet-captcha-go-mosipid1 @@ -103,27 +91,17 @@ extraEnvVarsAdditional: # Plugin 2: mosip-identity-plugin # Update URLs to match your MOSIP IDA deployment. # --------------------------------------------------------------------------- - - name: NAMESPACE - value: mosipid1 - - name: plugin_name_env - value: mosip-identity-plugin.jar - - name: SPRING_KAFKA_CONSUMER_GROUP_ID - value: esignet-consumer-esignet-mosipid1 - - name: MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE - value: esignet-mosipid1-signup-esqa020 - - name: MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS - value: email,phone - - name: MOSIP_ESIGNET_SEND_OTP_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX - value: '@phone' - - name: MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS + NAMESPACE: mosipid1 + plugin_name_env: mosip-identity-plugin.jar + SPRING_KAFKA_CONSUMER_GROUP_ID: esignet-consumer-esignet-mosipid1 + MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: esignet-mosipid1-signup-esqa020 + MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: email,phone + MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: '300' + MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' + MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: '600' + MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: '600' + MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: '@phone' + MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS: value: >- {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': @@ -134,13 +112,10 @@ extraEnvVarsAdditional: '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: INFO - - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED - value: "false" - - name: MOSIP_ESIGNET_CAPTCHA_URL - value: http://captcha.captcha - - name: "MOSIP_ESIGNET_MISP_KEY" + LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: INFO + MOSIP_ESIGNET_CAPTCHA_REQUIRED: "false" + MOSIP_ESIGNET_CAPTCHA_URL: http://captcha.captcha + "MOSIP_ESIGNET_MISP_KEY": valueFrom: secretKeyRef: name: esignet-misp-onboarder-key diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 9e5695a8e..ccb5f2dab 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -4,96 +4,82 @@ # Override full extraEnvVars to use namespace-specific softhsm secret name. extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL + KEYCLOAK_EXTERNAL_URL: valueFrom: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: REDIS_HOST + REDIS_HOST: valueFrom: configMapKeyRef: name: redis-config key: redis-host - - name: REDIS_PORT + REDIS_PORT: valueFrom: configMapKeyRef: name: redis-config key: redis-port - - name: REDIS_PASSWORD + REDIS_PASSWORD: valueFrom: secretKeyRef: name: redis key: redis-password - - name: DATABASE_HOST + DATABASE_HOST: valueFrom: configMapKeyRef: name: postgres-config key: database-host - - name: DATABASE_PORT + DATABASE_PORT: valueFrom: configMapKeyRef: name: postgres-config key: database-port - - name: DATABASE_NAME + DATABASE_NAME: valueFrom: configMapKeyRef: name: postgres-config key: database-name - - name: DATABASE_USERNAME + DATABASE_USERNAME: valueFrom: configMapKeyRef: name: postgres-config key: database-username - - name: DB_DBUSER_PASSWORD + DB_DBUSER_PASSWORD: valueFrom: secretKeyRef: name: db-common-secrets key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN + SOFTHSM_ESIGNET_SECURITY_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go-mosipid2 key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET + MOSIP_IDA_CLIENT_SECRET: valueFrom: secretKeyRef: name: keycloak-client-secrets-mosipid2 key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: KEYMANAGER_DB_SCHEMA - value: esignet - - name: KEYMANAGER_KEYSTORE_TYPE - value: PKCS11 - - name: KEYMANAGER_PKCS11_MODULE_PATH - value: /usr/lib/softhsm/libsofthsm2.so - - name: KEYMANAGER_PKCS11_TOKEN_LABEL - value: esignet - - name: KEYMANAGER_PKCS11_SLOT_ID - value: "0" - - name: KEYMANAGER_PKCS11_PIN + AUTHN_PROVIDER: mosip + KEYMANAGER_DB_SCHEMA: esignet + KEYMANAGER_KEYSTORE_TYPE: PKCS11 + KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so + KEYMANAGER_PKCS11_TOKEN_LABEL: esignet + KEYMANAGER_PKCS11_SLOT_ID: "0" + KEYMANAGER_PKCS11_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go-mosipid2 key: security-pin - - name: OIDC_UI_SCHEME - value: https - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 + OIDC_UI_SCHEME: https + OIDC_UI_PORT: '443' + OIDC_UI_LOGIN_PATH: /signin + OIDC_UI_ERROR_PATH: /error + DEFAULT_THEME_ID: decl-theme-1 + DEFAULT_LAYOUT_ID: decl-layout-1 + DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetgomosipid2" - - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" + "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME": "esignetgomosipid2" + "MOSIP_ESIGNET_CAPTCHA_SITE-KEY": valueFrom: secretKeyRef: name: esignet-captcha-go-mosipid2 @@ -103,27 +89,17 @@ extraEnvVarsAdditional: # Plugin 2: mosip-identity-plugin # Update URLs to match your MOSIP IDA deployment. # --------------------------------------------------------------------------- - - name: NAMESPACE - value: mosipid2 - - name: plugin_name_env - value: mosip-identity-plugin.jar - - name: SPRING_KAFKA_CONSUMER_GROUP_ID - value: esignet-consumer-esignet-mosipid2 - - name: MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE - value: esignet-mosipid2-signup-esqa020 - - name: MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS - value: email,phone - - name: MOSIP_ESIGNET_SEND_OTP_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX - value: '@phone' - - name: MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS + NAMESPACE: mosipid2 + plugin_name_env: mosip-identity-plugin.jar + SPRING_KAFKA_CONSUMER_GROUP_ID: esignet-consumer-esignet-mosipid2 + MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: esignet-mosipid2-signup-esqa020 + MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: email,phone + MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: '300' + MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' + MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: '600' + MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: '600' + MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: '@phone' + MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS: value: >- {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': @@ -134,13 +110,10 @@ extraEnvVarsAdditional: '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: INFO - - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED - value: "" - - name: MOSIP_ESIGNET_CAPTCHA_URL - value: http://captcha.captcha - - name: "MOSIP_ESIGNET_MISP_KEY" + LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: INFO + MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + MOSIP_ESIGNET_CAPTCHA_URL: http://captcha.captcha + "MOSIP_ESIGNET_MISP_KEY": valueFrom: secretKeyRef: name: esignet-misp-onboarder-key diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index b10407528..44beb2993 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -11,99 +11,85 @@ extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL + KEYCLOAK_EXTERNAL_URL: valueFrom: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: MOSIP_ESIGNET_CAPTCHA_SITE_KEY + MOSIP_ESIGNET_CAPTCHA_SITE_KEY: valueFrom: secretKeyRef: name: esignet-captcha-go key: esignet-captcha-site-key - - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignetgo - - name: REDIS_HOST + MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: esignetgo + REDIS_HOST: valueFrom: configMapKeyRef: name: redis-config key: redis-host - - name: REDIS_PORT + REDIS_PORT: valueFrom: configMapKeyRef: name: redis-config key: redis-port - - name: REDIS_PASSWORD + REDIS_PASSWORD: valueFrom: secretKeyRef: name: redis key: redis-password - - name: DATABASE_HOST + DATABASE_HOST: valueFrom: configMapKeyRef: name: postgres-config key: database-host - - name: DATABASE_PORT + DATABASE_PORT: valueFrom: configMapKeyRef: name: postgres-config key: database-port - - name: DATABASE_NAME + DATABASE_NAME: valueFrom: configMapKeyRef: name: postgres-config key: database-name - - name: DATABASE_USERNAME + DATABASE_USERNAME: valueFrom: configMapKeyRef: name: postgres-config key: database-username - - name: DB_DBUSER_PASSWORD + DB_DBUSER_PASSWORD: valueFrom: secretKeyRef: name: db-common-secrets key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN + SOFTHSM_ESIGNET_SECURITY_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET + MOSIP_IDA_CLIENT_SECRET: valueFrom: secretKeyRef: name: keycloak-client-secrets key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: KEYMANAGER_DB_SCHEMA - value: esignet - - name: KEYMANAGER_KEYSTORE_TYPE - value: PKCS11 - - name: KEYMANAGER_PKCS11_MODULE_PATH - value: /usr/lib/softhsm/libsofthsm2.so - - name: KEYMANAGER_PKCS11_TOKEN_LABEL - value: esignet - - name: KEYMANAGER_PKCS11_SLOT_ID - value: "0" - - name: KEYMANAGER_PKCS11_PIN + AUTHN_PROVIDER: mosip + KEYMANAGER_DB_SCHEMA: esignet + KEYMANAGER_KEYSTORE_TYPE: PKCS11 + KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so + KEYMANAGER_PKCS11_TOKEN_LABEL: esignet + KEYMANAGER_PKCS11_SLOT_ID: "0" + KEYMANAGER_PKCS11_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go key: security-pin - - name: OIDC_UI_SCHEME - value: https - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 + OIDC_UI_SCHEME: https + OIDC_UI_PORT: '443' + OIDC_UI_LOGIN_PATH: /signin + OIDC_UI_ERROR_PATH: /error + DEFAULT_THEME_ID: decl-theme-1 + DEFAULT_LAYOUT_ID: decl-layout-1 + DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 # extraEnvVarsCM: # - esignet-softhsm-share @@ -117,18 +103,17 @@ extraEnvVars: # prefix: /v1/esignet/ -# extraEnvVarsAdditional is a Helm list — this file REPLACES the base list on merge. -# All required entries (captcha + plugin-specific) must be present together. +# extraEnvVarsAdditional is a map — entries here deep-merge with the chart's own +# defaults key-by-key, so only the entries that differ need to be listed here. extraEnvVarsAdditional: # Captcha site key — from esignet-captcha secret (deployed by external-dsf) - - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" + "MOSIP_ESIGNET_CAPTCHA_SITE_KEY": valueFrom: secretKeyRef: name: esignet-captcha-go key: esignet-captcha-site-key - - name: "MOSIP_ESIGNET_CAPTCHA_REQUIRED" - value: "" + "MOSIP_ESIGNET_CAPTCHA_REQUIRED": "" # --------------------------------------------------------------------------- # Plugin 2: mosip-identity-plugin @@ -136,25 +121,16 @@ extraEnvVarsAdditional: # Update URLs to match your MOSIP IDA deployment if the defaults don't apply. # --------------------------------------------------------------------------- # - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL" - # value: "http://mosip-file-server.mosip-file-server/mosip-certs/ida-partner.cer" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-AUTH-URL" - # value: "http://ida-auth.ida/idauthentication/v1/kyc-auth/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-EXCHANGE-URL" - # value: "http://ida-auth.ida/idauthentication/v1/kyc-exchange/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_SEND-OTP-URL" - # value: "http://ida-otp.ida/idauthentication/v1/otp/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_BINDER_IDA_KEY-BINDING-URL" - # value: "http://ida-auth.ida/idauthentication/v1/identity-key-binding/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_GET-CERTIFICATES-URL" - # value: "http://ida-internal.ida/idauthentication/v1/internal/getAllCertificates" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH-TOKEN-URL" - # value: "http://authmanager.kernel/v1/authmanager/authenticate/clientidsecretkey" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT-MANAGER-URL" - # value: "http://auditmanager.kernel/v1/auditmanager/audits" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP-CHANNELS" - # value: "email,phone" - # - name: "MOSIP_ESIGNET_MISP_KEY" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL": "http://mosip-file-server.mosip-file-server/mosip-certs/ida-partner.cer" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-AUTH-URL": "http://ida-auth.ida/idauthentication/v1/kyc-auth/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-EXCHANGE-URL": "http://ida-auth.ida/idauthentication/v1/kyc-exchange/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_SEND-OTP-URL": "http://ida-otp.ida/idauthentication/v1/otp/${mosip.esignet.authenticator.ida.misp-license-key}/" + # "MOSIP_ESIGNET_BINDER_IDA_KEY-BINDING-URL": "http://ida-auth.ida/idauthentication/v1/identity-key-binding/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_GET-CERTIFICATES-URL": "http://ida-internal.ida/idauthentication/v1/internal/getAllCertificates" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH-TOKEN-URL": "http://authmanager.kernel/v1/authmanager/authenticate/clientidsecretkey" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT-MANAGER-URL": "http://auditmanager.kernel/v1/auditmanager/audits" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP-CHANNELS": "email,phone" + # "MOSIP_ESIGNET_MISP_KEY": # valueFrom: # secretKeyRef: # name: esignet-misp-onboarder-key @@ -166,11 +142,7 @@ extraEnvVarsAdditional: # Set MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL to your Sunbird registry host. # --------------------------------------------------------------------------- # - # - name: "MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL" - # value: "https://your-sunbird-registry-host" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL" - # value: "https://your-sunbird-registry-host/api/v1/Insurance/search" - # - name: "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN" - # value: "LoggerAuditService" - # - name: "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER" - # value: "NoOpKeyBinder" + # "MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL": "https://your-sunbird-registry-host" + # "MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL": "https://your-sunbird-registry-host/api/v1/Insurance/search" + # "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN": "LoggerAuditService" + # "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER": "NoOpKeyBinder" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index 80ec0bb63..3b13c1508 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -4,113 +4,94 @@ # Override full extraEnvVars to use namespace-specific softhsm secret name. extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL + KEYCLOAK_EXTERNAL_URL: valueFrom: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignetgosunbird - - name: REDIS_HOST + MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: esignetgosunbird + REDIS_HOST: valueFrom: configMapKeyRef: name: redis-config key: redis-host - - name: REDIS_PORT + REDIS_PORT: valueFrom: configMapKeyRef: name: redis-config key: redis-port - - name: REDIS_PASSWORD + REDIS_PASSWORD: valueFrom: secretKeyRef: name: redis key: redis-password - - name: DATABASE_HOST + DATABASE_HOST: valueFrom: configMapKeyRef: name: postgres-config key: database-host - - name: DATABASE_PORT + DATABASE_PORT: valueFrom: configMapKeyRef: name: postgres-config key: database-port - - name: DATABASE_NAME + DATABASE_NAME: valueFrom: configMapKeyRef: name: postgres-config key: database-name - - name: DATABASE_USERNAME + DATABASE_USERNAME: valueFrom: configMapKeyRef: name: postgres-config key: database-username - - name: DB_DBUSER_PASSWORD + DB_DBUSER_PASSWORD: valueFrom: secretKeyRef: name: db-common-secrets key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN + SOFTHSM_ESIGNET_SECURITY_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go-sunbird key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET + MOSIP_IDA_CLIENT_SECRET: valueFrom: secretKeyRef: name: keycloak-client-secrets key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: KEYMANAGER_DB_SCHEMA - value: esignet - - name: KEYMANAGER_KEYSTORE_TYPE - value: PKCS11 - - name: KEYMANAGER_PKCS11_MODULE_PATH - value: /usr/lib/softhsm/libsofthsm2.so - - name: KEYMANAGER_PKCS11_TOKEN_LABEL - value: esignet - - name: KEYMANAGER_PKCS11_SLOT_ID - value: "0" - - name: KEYMANAGER_PKCS11_PIN + AUTHN_PROVIDER: mosip + KEYMANAGER_DB_SCHEMA: esignet + KEYMANAGER_KEYSTORE_TYPE: PKCS11 + KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so + KEYMANAGER_PKCS11_TOKEN_LABEL: esignet + KEYMANAGER_PKCS11_SLOT_ID: "0" + KEYMANAGER_PKCS11_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go-sunbird key: security-pin - - name: OIDC_UI_SCHEME - value: https - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 + OIDC_UI_SCHEME: https + OIDC_UI_PORT: '443' + OIDC_UI_LOGIN_PATH: /signin + OIDC_UI_ERROR_PATH: /error + DEFAULT_THEME_ID: decl-theme-1 + DEFAULT_LAYOUT_ID: decl-layout-1 + DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" + "MOSIP_ESIGNET_CAPTCHA_SITE_KEY": valueFrom: secretKeyRef: name: esignet-captcha-go-sunbird key: esignet-captcha-site-key - - name: "MOSIP_ESIGNET_CAPTCHA_REQUIRED" - value: "" + "MOSIP_ESIGNET_CAPTCHA_REQUIRED": "" # --------------------------------------------------------------------------- # Plugin 3: sunbird-rc-plugin # Update URLs to match your Sunbird RC registry deployment. # --------------------------------------------------------------------------- - - name: "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN" - value: "LoggerAuditService" - - name: "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER" - value: "NoOpKeyBinder" - - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD - value: "policyNumber" + "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN": "LoggerAuditService" + "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER": "NoOpKeyBinder" + MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' + MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD: "policyNumber" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml index 1cbf9dc1e..daeb84499 100755 --- a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml @@ -1,49 +1,47 @@ extraEnvVars: - - name: DATABASE_HOST + DATABASE_HOST: valueFrom: configMapKeyRef: name: mockid-postgres-config key: database-host - - name: DATABASE_PORT + DATABASE_PORT: valueFrom: configMapKeyRef: name: mockid-postgres-config key: database-port - - name: DATABASE_NAME + DATABASE_NAME: valueFrom: configMapKeyRef: name: mockid-postgres-config key: database-name - - name: DATABASE_USERNAME + DATABASE_USERNAME: valueFrom: configMapKeyRef: name: mockid-postgres-config key: database-username - - name: DB_DBUSER_PASSWORD + DB_DBUSER_PASSWORD: valueFrom: secretKeyRef: name: db-common-secrets key: db-dbuser-password - - name: SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN + SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN: valueFrom: secretKeyRef: name: softhsm-mock-identity-system-go key: security-pin - - name: hsm_local_dir_name - value: hsm-client - - name: MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS - value: individualId,password - - name: REDIS_HOST + hsm_local_dir_name: hsm-client + MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: individualId,password + REDIS_HOST: valueFrom: configMapKeyRef: name: redis-config key: redis-host - - name: REDIS_PORT + REDIS_PORT: valueFrom: configMapKeyRef: name: redis-config key: redis-port - - name: REDIS_PASSWORD + REDIS_PASSWORD: valueFrom: secretKeyRef: name: redis diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml index 152594a8b..24abf63e6 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml @@ -1,18 +1,13 @@ extraEnvVars: - - name: CLIENT_ID - value: I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM - - name: ACRS + CLIENT_ID: I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM + ACRS: value: >- mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge - - name: DISPLAY - value: page - - name: GRANT_TYPE - value: authorization_code - - name: CLAIMS_LOCALES - value: en - - name: SCOPE_USER_PROFILE - value: openid profile - - name: CLAIMS_USER_PROFILE + DISPLAY: page + GRANT_TYPE: authorization_code + CLAIMS_LOCALES: en + SCOPE_USER_PROFILE: openid profile + CLAIMS_USER_PROFILE: value: >- {"userinfo":{"given_name":{"essential":true},"phone_number":{"essential":true},"email":{"essential":true},"picture":{"essential":false},"gender":{"essential":false},"birthdate":{"essential":false},"address":{"essential":false}},"id_token":{}} mock_relying_party_service: From cbb680bdc205b41eb2e66445ed12b049df82a346 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 11:53:19 +0530 Subject: [PATCH 045/127] fix: inline esignet-standalone-2.0.0 valuesFile content into DSF set: entries Now that extraEnvVars/extraEnvVarsAdditional are maps (commit 1f8713ac), every key can be expressed as an individual dot-path set: entry directly in esignet-dsf.yaml, matching the convention already used for domainConfig.KEY/extraEnvVarsCM[n] in this same file. Removes the valuesFile: reference and deletes the source file for each of the 6 converted apps (esignet base/sunbird/mosipid1/mosipid2, mock-identity, mock-relying-party x4) once nothing references it. Verified: full-manifest helm template diff (not just env:) for every app, comparing the original valuesFile + baseline set: render against the new set:-only render - byte-identical in every case. Checked for key overlap against existing domainConfig.*/set: entries first (none found) so nothing is duplicated. Two values (MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS, CLAIMS_USER_PROFILE) are JSON-like blobs full of commas and braces, which --set's mini-language treats specially. Escaped with \, \{ \} per Helm's strvals rules, wrapped in YAML single-quoted strings in the DSF (double-quoted YAML does NOT accept these as valid escapes - caught and fixed one instance of this during implementation). Verified end-to-end three ways: Helm's strvals parser directly, YAML round-trip via an independent parser, and Helmsman's own real binary (-dry-run -debug against a local, unreachable fake kubeconfig, network-free) - its internal "values to override from env" dump shows both escaped values recovered exactly as intended before being handed to Helm. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 292 +++++++++++++++++- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 122 -------- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 120 ------- .../esignet-plugin-values-2-0-0.yaml | 148 --------- .../esignet-sunbird-plugin-values-2-0-0.yaml | 97 ------ .../mock-identity-values-2-0-0.yaml | 48 --- .../mock-replying-party.yaml | 20 -- 7 files changed, 280 insertions(+), 567 deletions(-) delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml delete mode 100755 Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 0deca2876..17818f7a1 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -110,7 +110,6 @@ apps: enabled: true version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet" image.tag: "develop-go" @@ -132,6 +131,49 @@ apps: domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" domainConfig.OIDC_UI_HOSTNAME: "esignet-go.${domain_name}" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgo" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" timeout: 600 priority: -14 hooks: @@ -143,7 +185,6 @@ apps: enabled: true version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet" image.tag: "develop-go" @@ -173,7 +214,64 @@ apps: domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid1.${domain_name}" domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid1.${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid1.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid1.${domain_name}" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid1" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid1" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" + extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/keys/secret/mosipid1.pfx" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsSecret[0]: "esignet-keystore-go-mosipid1" + extraVolumes[0].name: "esignet-keystore-go-mosipid1" + extraVolumes[0].secret.secretName: "esignet-keystore-go-mosipid1" + extraVolumeMounts[0].name: "esignet-keystore-go-mosipid1" + extraVolumeMounts[0].mountPath: "/home/mosip/keys/secret" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.NAMESPACE: "mosipid1" + extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" + extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid1" + extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid1-signup-esqa020" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email\,phone' + extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: "@phone" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile''\, ''svg'': ''mobile_icon''\, ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND''\, ''value'': ''+91''\, ''maxLength'': ''''\, ''regex'': ''''\}\,\{''label'': ''KHM''\, ''value'': ''+855''\, ''regex'': ''''\{\{ "\}\}" \}\}\, ''postfix'': ''@phone''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''nrc''\, ''svg'': ''nrc_id_icon''\, ''prefixes'': ''''\, ''postfix'': ''@nrc''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''vid''\, ''svg'': ''vid_icon''\, ''prefixes'': ''''\, ''postfix'': ''''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''email''\, ''svg'': ''email_icon''\, ''prefixes'': ''''\, ''postfix'': ''@email''\, ''maxLength'': ''''\, ''regex'': '''' \{\{ "\}\}" \}\}' + extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "false" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" timeout: 600 priority: -14 hooks: @@ -184,7 +282,6 @@ apps: enabled: ${MOSIPID2_ENABLED} version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet" image.tag: "develop-go" @@ -214,7 +311,63 @@ apps: domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid2.${domain_name}" domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid2.${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid2.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid2.${domain_name}" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid2" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid2" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid2" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid2" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid2" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.NAMESPACE: "mosipid2" + extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" + extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid2" + extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid2-signup-esqa020" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email\,phone' + extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: "@phone" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile''\, ''svg'': ''mobile_icon''\, ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND''\, ''value'': ''+91''\, ''maxLength'': ''''\, ''regex'': ''''\}\,\{''label'': ''KHM''\, ''value'': ''+855''\, ''regex'': ''''\{\{ "\}\}" \}\}\, ''postfix'': ''@phone''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''nrc''\, ''svg'': ''nrc_id_icon''\, ''prefixes'': ''''\, ''postfix'': ''@nrc''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''vid''\, ''svg'': ''vid_icon''\, ''prefixes'': ''''\, ''postfix'': ''''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''email''\, ''svg'': ''email_icon''\, ''prefixes'': ''''\, ''postfix'': ''@email''\, ''maxLength'': ''''\, ''regex'': '''' \{\{ "\}\}" \}\}' + extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" timeout: 600 priority: -14 hooks: @@ -225,7 +378,6 @@ apps: enabled: true version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet" image.tag: "develop-go" @@ -249,7 +401,52 @@ apps: domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-sunbird.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-go-sunbird.${domain_name}" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgosunbird" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-sunbird" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-sunbird" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-sunbird" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + extraEnvVarsAdditional.MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN: "LoggerAuditService" + extraEnvVarsAdditional.MOSIP_ESIGNET_INTEGRATION_KEY_BINDER: "NoOpKeyBinder" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD: "policyNumber" timeout: 600 priority: -14 hooks: @@ -351,7 +548,6 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-identity-system - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml" set: image.repository: "mosipqa/mock-identity-system" image.tag: "develop" @@ -368,6 +564,26 @@ apps: domainConfig.installation-domain: "${domain_name}" domainConfig.MOSIP_MOCK_IDA_IDENTITY_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/email-signup-schema-testing.json" domainConfig.MOSIP_MOCK_UI_SPEC_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/ui_spec_reset_password_phone.json" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.name: "softhsm-mock-identity-system-go" + extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.hsm_local_dir_name: "hsm-client" + extraEnvVars.MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: 'individualId\,password' + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" timeout: 480 priority: -11 hooks: @@ -381,7 +597,6 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" @@ -392,6 +607,20 @@ apps: mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: @@ -402,7 +631,6 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" @@ -413,6 +641,20 @@ apps: mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: @@ -423,7 +665,6 @@ apps: enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/mock-relying-party-service - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" @@ -434,6 +675,20 @@ apps: mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: @@ -444,7 +699,6 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" @@ -455,6 +709,20 @@ apps: mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-sunbird.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml deleted file mode 100644 index af9553846..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,122 +0,0 @@ -# eSignet MOSIPID1 — plugin 2 (mosip-identity-plugin) runtime configuration. -# pluginNameEnv=mosip-identity-plugin.jar set in DSF set: block. -# Update IDA service URLs below to match your MOSIP IDA deployment. - -# Override full extraEnvVars to use namespace-specific softhsm secret name. -extraEnvVars: - KEYCLOAK_EXTERNAL_URL: - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - REDIS_HOST: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - REDIS_PORT: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - REDIS_PASSWORD: - valueFrom: - secretKeyRef: - name: redis - key: redis-password - DATABASE_HOST: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - DATABASE_PORT: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - DATABASE_NAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - DATABASE_USERNAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - DB_DBUSER_PASSWORD: - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - SOFTHSM_ESIGNET_SECURITY_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-mosipid1 - key: security-pin - MOSIP_IDA_CLIENT_SECRET: - valueFrom: - secretKeyRef: - name: keycloak-client-secrets-mosipid1 - key: mosip_ida_client_secret - AUTHN_PROVIDER: mosip - KEYMANAGER_DB_SCHEMA: esignet - KEYMANAGER_KEYSTORE_TYPE: PKCS12 - KEYMANAGER_PKCS12_FILE_PATH: /home/mosip/keys/secret/mosipid1.pfx - OIDC_UI_SCHEME: https - OIDC_UI_PORT: '443' - OIDC_UI_LOGIN_PATH: /signin - OIDC_UI_ERROR_PATH: /error - DEFAULT_THEME_ID: decl-theme-1 - DEFAULT_LAYOUT_ID: decl-layout-1 - DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 -extraEnvVarsSecret: - - esignet-keystore-go-mosipid1 -extraVolumes: - - name: esignet-keystore-go-mosipid1 - secret: - secretName: esignet-keystore-go-mosipid1 -extraVolumeMounts: - - name: esignet-keystore-go-mosipid1 - mountPath: /home/mosip/keys/secret -extraEnvVarsAdditional: - "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME": "esignetgomosipid1" - "MOSIP_ESIGNET_CAPTCHA_SITE-KEY": - valueFrom: - secretKeyRef: - name: esignet-captcha-go-mosipid1 - key: esignet-captcha-site-key - - # --------------------------------------------------------------------------- - # Plugin 2: mosip-identity-plugin - # Update URLs to match your MOSIP IDA deployment. - # --------------------------------------------------------------------------- - NAMESPACE: mosipid1 - plugin_name_env: mosip-identity-plugin.jar - SPRING_KAFKA_CONSUMER_GROUP_ID: esignet-consumer-esignet-mosipid1 - MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: esignet-mosipid1-signup-esqa020 - MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: email,phone - MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: '300' - MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' - MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: '600' - MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: '600' - MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: '@phone' - MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS: - value: >- - {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': - 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': - 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', - 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': - 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': - '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': - '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': - 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': - '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: INFO - MOSIP_ESIGNET_CAPTCHA_REQUIRED: "false" - MOSIP_ESIGNET_CAPTCHA_URL: http://captcha.captcha - "MOSIP_ESIGNET_MISP_KEY": - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml deleted file mode 100644 index ccb5f2dab..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,120 +0,0 @@ -# eSignet MOSIPID2 — plugin 2 (mosip-identity-plugin) runtime configuration. -# pluginNameEnv=mosip-identity-plugin.jar set in DSF set: block. -# Update IDA service URLs below to match your MOSIP IDA deployment. - -# Override full extraEnvVars to use namespace-specific softhsm secret name. -extraEnvVars: - KEYCLOAK_EXTERNAL_URL: - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - REDIS_HOST: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - REDIS_PORT: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - REDIS_PASSWORD: - valueFrom: - secretKeyRef: - name: redis - key: redis-password - DATABASE_HOST: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - DATABASE_PORT: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - DATABASE_NAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - DATABASE_USERNAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - DB_DBUSER_PASSWORD: - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - SOFTHSM_ESIGNET_SECURITY_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-mosipid2 - key: security-pin - MOSIP_IDA_CLIENT_SECRET: - valueFrom: - secretKeyRef: - name: keycloak-client-secrets-mosipid2 - key: mosip_ida_client_secret - AUTHN_PROVIDER: mosip - KEYMANAGER_DB_SCHEMA: esignet - KEYMANAGER_KEYSTORE_TYPE: PKCS11 - KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so - KEYMANAGER_PKCS11_TOKEN_LABEL: esignet - KEYMANAGER_PKCS11_SLOT_ID: "0" - KEYMANAGER_PKCS11_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-mosipid2 - key: security-pin - OIDC_UI_SCHEME: https - OIDC_UI_PORT: '443' - OIDC_UI_LOGIN_PATH: /signin - OIDC_UI_ERROR_PATH: /error - DEFAULT_THEME_ID: decl-theme-1 - DEFAULT_LAYOUT_ID: decl-layout-1 - DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 -extraEnvVarsAdditional: - "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME": "esignetgomosipid2" - "MOSIP_ESIGNET_CAPTCHA_SITE-KEY": - valueFrom: - secretKeyRef: - name: esignet-captcha-go-mosipid2 - key: esignet-captcha-site-key - - # --------------------------------------------------------------------------- - # Plugin 2: mosip-identity-plugin - # Update URLs to match your MOSIP IDA deployment. - # --------------------------------------------------------------------------- - NAMESPACE: mosipid2 - plugin_name_env: mosip-identity-plugin.jar - SPRING_KAFKA_CONSUMER_GROUP_ID: esignet-consumer-esignet-mosipid2 - MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: esignet-mosipid2-signup-esqa020 - MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: email,phone - MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: '300' - MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' - MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: '600' - MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: '600' - MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: '@phone' - MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS: - value: >- - {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': - 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': - 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', - 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': - 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': - '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': - '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': - 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': - '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: INFO - MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" - MOSIP_ESIGNET_CAPTCHA_URL: http://captcha.captcha - "MOSIP_ESIGNET_MISP_KEY": - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml deleted file mode 100644 index 44beb2993..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,148 +0,0 @@ -# eSignet standalone — plugin and captcha runtime configuration. -# -# Plugin selection: -# Plugin 1 (mock): pluginNameEnv=esignet-mock-plugin.jar → no changes needed here -# Plugin 2 (mosip-identity): pluginNameEnv=mosip-identity-plugin.jar → uncomment IDA section below -# Plugin 3 (sunbird-rc): pluginNameEnv=sunbird-rc-plugin.jar → uncomment Sunbird section below -# Plugin 4 (custom): pluginNameEnv= pluginUrlEnv= → no changes needed here -# - -## Uncomment required parms added with single '#' when needed. - - -extraEnvVars: - KEYCLOAK_EXTERNAL_URL: - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - MOSIP_ESIGNET_CAPTCHA_SITE_KEY: - valueFrom: - secretKeyRef: - name: esignet-captcha-go - key: esignet-captcha-site-key - MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: esignetgo - REDIS_HOST: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - REDIS_PORT: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - REDIS_PASSWORD: - valueFrom: - secretKeyRef: - name: redis - key: redis-password - DATABASE_HOST: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - DATABASE_PORT: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - DATABASE_NAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - DATABASE_USERNAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - DB_DBUSER_PASSWORD: - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - SOFTHSM_ESIGNET_SECURITY_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go - key: security-pin - MOSIP_IDA_CLIENT_SECRET: - valueFrom: - secretKeyRef: - name: keycloak-client-secrets - key: mosip_ida_client_secret - AUTHN_PROVIDER: mosip - KEYMANAGER_DB_SCHEMA: esignet - KEYMANAGER_KEYSTORE_TYPE: PKCS11 - KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so - KEYMANAGER_PKCS11_TOKEN_LABEL: esignet - KEYMANAGER_PKCS11_SLOT_ID: "0" - KEYMANAGER_PKCS11_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go - key: security-pin - OIDC_UI_SCHEME: https - OIDC_UI_PORT: '443' - OIDC_UI_LOGIN_PATH: /signin - OIDC_UI_ERROR_PATH: /error - DEFAULT_THEME_ID: decl-theme-1 - DEFAULT_LAYOUT_ID: decl-layout-1 - DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 -# extraEnvVarsCM: -# - esignet-softhsm-share - -#extraEnvVarsSecret: [] - -#istio: -# enabled: true -# gateways: -# - istio-system/public -# - istio-system/internal -# prefix: /v1/esignet/ - - -# extraEnvVarsAdditional is a map — entries here deep-merge with the chart's own -# defaults key-by-key, so only the entries that differ need to be listed here. - -extraEnvVarsAdditional: - # Captcha site key — from esignet-captcha secret (deployed by external-dsf) - "MOSIP_ESIGNET_CAPTCHA_SITE_KEY": - valueFrom: - secretKeyRef: - name: esignet-captcha-go - key: esignet-captcha-site-key - "MOSIP_ESIGNET_CAPTCHA_REQUIRED": "" - - # --------------------------------------------------------------------------- - # Plugin 2: mosip-identity-plugin - # Uncomment all entries below when pluginNameEnv=mosip-identity-plugin.jar. - # Update URLs to match your MOSIP IDA deployment if the defaults don't apply. - # --------------------------------------------------------------------------- - # - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL": "http://mosip-file-server.mosip-file-server/mosip-certs/ida-partner.cer" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-AUTH-URL": "http://ida-auth.ida/idauthentication/v1/kyc-auth/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-EXCHANGE-URL": "http://ida-auth.ida/idauthentication/v1/kyc-exchange/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_SEND-OTP-URL": "http://ida-otp.ida/idauthentication/v1/otp/${mosip.esignet.authenticator.ida.misp-license-key}/" - # "MOSIP_ESIGNET_BINDER_IDA_KEY-BINDING-URL": "http://ida-auth.ida/idauthentication/v1/identity-key-binding/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_GET-CERTIFICATES-URL": "http://ida-internal.ida/idauthentication/v1/internal/getAllCertificates" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH-TOKEN-URL": "http://authmanager.kernel/v1/authmanager/authenticate/clientidsecretkey" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT-MANAGER-URL": "http://auditmanager.kernel/v1/auditmanager/audits" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP-CHANNELS": "email,phone" - # "MOSIP_ESIGNET_MISP_KEY": - # valueFrom: - # secretKeyRef: - # name: esignet-misp-onboarder-key - # key: mosip-esignet-misp-key - - # --------------------------------------------------------------------------- - # Plugin 3: sunbird-rc-plugin - # Uncomment all entries below when pluginNameEnv=sunbird-rc-plugin.jar. - # Set MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL to your Sunbird registry host. - # --------------------------------------------------------------------------- - # - # "MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL": "https://your-sunbird-registry-host" - # "MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL": "https://your-sunbird-registry-host/api/v1/Insurance/search" - # "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN": "LoggerAuditService" - # "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER": "NoOpKeyBinder" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml deleted file mode 100644 index 3b13c1508..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,97 +0,0 @@ -# eSignet Sunbird — plugin 3 (sunbird-rc-plugin) runtime configuration. -# pluginNameEnv=sunbird-rc-plugin.jar set in DSF set: block. -# Update MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL to your Sunbird registry host. - -# Override full extraEnvVars to use namespace-specific softhsm secret name. -extraEnvVars: - KEYCLOAK_EXTERNAL_URL: - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: esignetgosunbird - REDIS_HOST: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - REDIS_PORT: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - REDIS_PASSWORD: - valueFrom: - secretKeyRef: - name: redis - key: redis-password - DATABASE_HOST: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - DATABASE_PORT: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - DATABASE_NAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - DATABASE_USERNAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - DB_DBUSER_PASSWORD: - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - SOFTHSM_ESIGNET_SECURITY_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-sunbird - key: security-pin - MOSIP_IDA_CLIENT_SECRET: - valueFrom: - secretKeyRef: - name: keycloak-client-secrets - key: mosip_ida_client_secret - AUTHN_PROVIDER: mosip - KEYMANAGER_DB_SCHEMA: esignet - KEYMANAGER_KEYSTORE_TYPE: PKCS11 - KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so - KEYMANAGER_PKCS11_TOKEN_LABEL: esignet - KEYMANAGER_PKCS11_SLOT_ID: "0" - KEYMANAGER_PKCS11_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-sunbird - key: security-pin - OIDC_UI_SCHEME: https - OIDC_UI_PORT: '443' - OIDC_UI_LOGIN_PATH: /signin - OIDC_UI_ERROR_PATH: /error - DEFAULT_THEME_ID: decl-theme-1 - DEFAULT_LAYOUT_ID: decl-layout-1 - DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 - -extraEnvVarsAdditional: - "MOSIP_ESIGNET_CAPTCHA_SITE_KEY": - valueFrom: - secretKeyRef: - name: esignet-captcha-go-sunbird - key: esignet-captcha-site-key - "MOSIP_ESIGNET_CAPTCHA_REQUIRED": "" - - # --------------------------------------------------------------------------- - # Plugin 3: sunbird-rc-plugin - # Update URLs to match your Sunbird RC registry deployment. - # --------------------------------------------------------------------------- - "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN": "LoggerAuditService" - "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER": "NoOpKeyBinder" - MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' - MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD: "policyNumber" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml deleted file mode 100755 index daeb84499..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml +++ /dev/null @@ -1,48 +0,0 @@ -extraEnvVars: - DATABASE_HOST: - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-host - DATABASE_PORT: - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-port - DATABASE_NAME: - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-name - DATABASE_USERNAME: - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-username - DB_DBUSER_PASSWORD: - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN: - valueFrom: - secretKeyRef: - name: softhsm-mock-identity-system-go - key: security-pin - hsm_local_dir_name: hsm-client - MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: individualId,password - REDIS_HOST: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - REDIS_PORT: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - REDIS_PASSWORD: - valueFrom: - secretKeyRef: - name: redis - key: redis-password diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml deleted file mode 100644 index 24abf63e6..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml +++ /dev/null @@ -1,20 +0,0 @@ -extraEnvVars: - CLIENT_ID: I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM - ACRS: - value: >- - mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge - DISPLAY: page - GRANT_TYPE: authorization_code - CLAIMS_LOCALES: en - SCOPE_USER_PROFILE: openid profile - CLAIMS_USER_PROFILE: - value: >- - {"userinfo":{"given_name":{"essential":true},"phone_number":{"essential":true},"email":{"essential":true},"picture":{"essential":false},"gender":{"essential":false},"birthdate":{"essential":false},"address":{"essential":false}},"id_token":{}} -mock_relying_party_service: - host: '' - mountDir: "" # path inside docker - healthCheckUrl: - mock_relying_party_serviceMountDIr: /home/mosip/oidc/ - puburl: - privurl: - USERINFO_RESPONSE_TYPE: jwt From 38f920a9c34cc1b8a4fa2fedd2181c2806ec455d Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 12:20:44 +0530 Subject: [PATCH 046/127] fix: remove extraVolumes/extraVolumeMounts from esignet-go-mosipid1 The extraVolumes/extraVolumeMounts chart feature these referenced was deleted from the esignet chart. Drop the corresponding set: entries. extraEnvVarsSecret[0] stays - it's the chart's pre-existing envFrom secretRef mechanism, unrelated to the removed volume-mount feature, even though it happened to reference the same secret name. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 17818f7a1..6e542d435 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -249,10 +249,6 @@ apps: extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" extraEnvVarsSecret[0]: "esignet-keystore-go-mosipid1" - extraVolumes[0].name: "esignet-keystore-go-mosipid1" - extraVolumes[0].secret.secretName: "esignet-keystore-go-mosipid1" - extraVolumeMounts[0].name: "esignet-keystore-go-mosipid1" - extraVolumeMounts[0].mountPath: "/home/mosip/keys/secret" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" From bc97de4d59f897b964d0a8e2bc7f0ab69ec523ed Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 12:25:58 +0530 Subject: [PATCH 047/127] fix: remove unused extraEnvVarsSecret from esignet-go-mosipid1 esignet-keystore-go-mosipid1 secret is not being used. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 6e542d435..49007afba 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -248,7 +248,6 @@ apps: extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsSecret[0]: "esignet-keystore-go-mosipid1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" From f3aba85934ab78b52d8736c123455bf6cc1df12c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 15:22:58 +0530 Subject: [PATCH 048/127] Drop -go suffix and consolidate mosipid1/mosipid2 in esignet-standalone-2.0.0 DSF The Go rewrite profile used a -go suffix on release/namespace/hostnames solely to avoid colliding with the parallel v1.7.1 (non-Go) profile. That profile is retired, so the suffix is no longer needed. Also consolidates the separate mosipid1 (PKCS12) and mosipid2 (PKCS11) instances into a single mosipid instance, keeping mosipid2's PKCS11 config as canonical. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 548 ++++++------------ .../esignet-standalone-2.0.0/signup-dsf.yaml | 50 +- .../testrigs-dsf.yaml | 119 ++-- .../config-server-esignet-values-2-0-0.yaml | 6 +- ...ml => softhsm-esignet-mosipid-values.yaml} | 2 +- .../softhsm-esignet-mosipid2-values.yaml | 28 - 6 files changed, 226 insertions(+), 527 deletions(-) rename Helmsman/utils/{softhsm-esignet-mosipid1-values.yaml => softhsm-esignet-mosipid-values.yaml} (90%) delete mode 100644 Helmsman/utils/softhsm-esignet-mosipid2-values.yaml diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 49007afba..c11e97a7e 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -28,15 +28,13 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm namespaces: - esignet-go-mock: + esignet-mock: protected: false - softhsm-go: + softhsm: protected: false - esignet-go-mosipid1: + esignet-mosipid: protected: false - esignet-go-mosipid2: - protected: false - esignet-go-sunbird: + esignet-sunbird: protected: false apps: @@ -45,8 +43,8 @@ apps: # --------------------------------------------------------------------------- # Deployed here (not in external-dsf) so esignet-softhsm-share configmap is # available in esignet namespace before eSignet service starts. - esignet-softhsm-go: - namespace: esignet-go-mock + esignet-softhsm: + namespace: esignet-mock enabled: true version: 12.0.1 chart: mosip/softhsm @@ -56,30 +54,19 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" - esignet-softhsm-go-mosipid1: - namespace: esignet-go-mosipid1 + esignet-softhsm-mosipid: + namespace: esignet-mosipid enabled: true version: 12.0.1 chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid1-values.yaml" - timeout: 480 - priority: -16 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh" - - esignet-softhsm-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 12.0.1 - chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid2-values.yaml" + valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid-values.yaml" timeout: 480 priority: -16 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh" - esignet-softhsm-go-sunbird: - namespace: esignet-go-sunbird + esignet-softhsm-sunbird: + namespace: esignet-sunbird enabled: true version: 12.0.1 chart: mosip/softhsm @@ -89,8 +76,8 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh" - esignet-config-server-go: - namespace: esignet-go-mock + esignet-config-server: + namespace: esignet-mock enabled: false version: 12.0.1 chart: mosip/config-server @@ -105,8 +92,8 @@ apps: # --------------------------------------------------------------------------- # eSignet # --------------------------------------------------------------------------- - esignet-go-mock: - namespace: esignet-go-mock + esignet-mock: + namespace: esignet-mock enabled: true version: 2.0.0-develop chart: mosip/esignet @@ -118,11 +105,11 @@ apps: activeProfileEnv: "" pluginNameEnv: "esignet-mock-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-share" + extraEnvVarsCM[0]: "esignet-softhsm-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" @@ -130,12 +117,12 @@ apps: domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" - extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" - extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgo" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignet" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" @@ -152,7 +139,7 @@ apps: extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" - extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" @@ -162,7 +149,7 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -171,7 +158,7 @@ apps: extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" timeout: 600 @@ -180,8 +167,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh" - esignet-go-mosipid1: - namespace: esignet-go-mosipid1 + esignet-mosipid: + namespace: esignet-mosipid enabled: true version: 2.0.0-develop chart: mosip/esignet @@ -193,28 +180,28 @@ apps: activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid1-share" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid1.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid1.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid1_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid1_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid1_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid1.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid1.${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid1.${domain_name}" + domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid_domain_name}/mosip-certs/ida-partner.cer" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid_domain_name}/v1/authmanager/authenticate/clientidsecretkey" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid_domain_name}/v1/auditmanager/audits" + domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-mosipid.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" @@ -233,101 +220,9 @@ apps: extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" - extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid1" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" - extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid1" - extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" - extraEnvVars.AUTHN_PROVIDER: "mosip" - extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" - extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/keys/secret/mosipid1.pfx" - extraEnvVars.OIDC_UI_SCHEME: "https" - extraEnvVars.OIDC_UI_PORT: "443" - extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" - extraEnvVars.OIDC_UI_ERROR_PATH: "/error" - extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" - extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" - extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" - extraEnvVarsAdditional.NAMESPACE: "mosipid1" - extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" - extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid1" - extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid1-signup-esqa020" - extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email\,phone' - extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" - extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" - extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: "600" - extraEnvVarsAdditional.MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: "600" - extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: "@phone" - extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile''\, ''svg'': ''mobile_icon''\, ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND''\, ''value'': ''+91''\, ''maxLength'': ''''\, ''regex'': ''''\}\,\{''label'': ''KHM''\, ''value'': ''+855''\, ''regex'': ''''\{\{ "\}\}" \}\}\, ''postfix'': ''@phone''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''nrc''\, ''svg'': ''nrc_id_icon''\, ''prefixes'': ''''\, ''postfix'': ''@nrc''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''vid''\, ''svg'': ''vid_icon''\, ''prefixes'': ''''\, ''postfix'': ''''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''email''\, ''svg'': ''email_icon''\, ''prefixes'': ''''\, ''postfix'': ''@email''\, ''maxLength'': ''''\, ''regex'': '''' \{\{ "\}\}" \}\}' - extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "false" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" - extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" - extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" - timeout: 600 - priority: -14 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh" - - esignet-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 2.0.0-develop - chart: mosip/esignet - set: - image.repository: "mosipqa/esignet" - image.tag: "develop-go" - enable_insecure: "false" - springConfigNameEnv: "" - activeProfileEnv: "" - pluginNameEnv: "mosip-identity-plugin.jar" - pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid2-share" - extraEnvVarsCM[1]: "esignet-global" - metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid2.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid2.${domain_name}" - domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" - domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" - domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid2_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid2_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid2_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid2.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid2.${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid2.${domain_name}" - extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" - extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" - extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" - extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" - extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" - extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" - extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" - extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" - extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" - extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" - extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" - extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" - extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" - extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" - extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" - extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" - extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" - extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" - extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid2" - extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" - extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid2" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" @@ -335,7 +230,7 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid2" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -344,13 +239,13 @@ apps: extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid2" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid2" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetmosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-mosipid" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" - extraEnvVarsAdditional.NAMESPACE: "mosipid2" + extraEnvVarsAdditional.NAMESPACE: "mosipid" extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" - extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid2" - extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid2-signup-esqa020" + extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid-signup-esqa020" extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email\,phone' extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" @@ -366,10 +261,10 @@ apps: timeout: 600 priority: -14 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh" - esignet-go-sunbird: - namespace: esignet-go-sunbird + esignet-sunbird: + namespace: esignet-sunbird enabled: true version: 2.0.0-develop chart: mosip/esignet @@ -381,11 +276,11 @@ apps: activeProfileEnv: "" pluginNameEnv: "sunbird-rc-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-sunbird-share" + extraEnvVarsCM[0]: "esignet-softhsm-sunbird-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-sunbird.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-sunbird.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" @@ -393,13 +288,13 @@ apps: domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-sunbird.${domain_name}" + domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" + domainConfig.OIDC_UI_HOSTNAME: "esignet-sunbird.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" - extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgosunbird" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetsunbird" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" @@ -416,7 +311,7 @@ apps: extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" - extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-sunbird" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" @@ -426,7 +321,7 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-sunbird" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -435,7 +330,7 @@ apps: extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-sunbird" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-sunbird" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" extraEnvVarsAdditional.MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN: "LoggerAuditService" @@ -450,70 +345,53 @@ apps: # --------------------------------------------------------------------------- # OIDC UI # --------------------------------------------------------------------------- - oidc-ui-go: - namespace: esignet-go-mock + oidc-ui: + namespace: esignet-mock enabled: true version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop-go" - istio.hosts[0]: "esignet-go.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-mock.esignet-go-mock" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mock.esignet-go-mock" + istio.hosts[0]: "esignet.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mock.esignet-mock" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mock.esignet-mock/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mock.esignet-mock" timeout: 1200 priority: -13 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" - oidc-ui-go-mosipid1: - namespace: esignet-go-mosipid1 + oidc-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop-go" - istio.hosts[0]: "esignet-go-mosipid1.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-mosipid1.esignet-go-mosipid1" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mosipid1.esignet-go-mosipid1" - timeout: 1200 - priority: -13 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh" - - oidc-ui-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 2.0.0-develop - chart: mosip/oidc-ui - set: - image.repository: "mosipqa/oidc-ui" - image.tag: "develop-go" - istio.hosts[0]: "esignet-go-mosipid2.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-mosipid2.esignet-go-mosipid2" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mosipid2.esignet-go-mosipid2" + istio.hosts[0]: "esignet-mosipid.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mosipid.esignet-mosipid" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid.esignet-mosipid" timeout: 1200 priority: -13 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh" - oidc-ui-go-sunbird: - namespace: esignet-go-sunbird + oidc-ui-sunbird: + namespace: esignet-sunbird enabled: true version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop-go" - istio.hosts[0]: "esignet-go-sunbird.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-sunbird.esignet-go-sunbird" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-sunbird.esignet-go-sunbird" + istio.hosts[0]: "esignet-sunbird.${domain_name}" + oidc_ui.oidc_service_host: "esignet-sunbird.esignet-sunbird" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-sunbird.esignet-sunbird/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-sunbird.esignet-sunbird" timeout: 1200 priority: -13 hooks: @@ -523,8 +401,8 @@ apps: # Mock Identity System (Optional) # --------------------------------------------------------------------------- # Enable for testing with mock identity data. - softhsm-mock-identity-system-go: - namespace: softhsm-go + softhsm-mock-identity-system: + namespace: softhsm enabled: true version: 12.0.1 chart: mosip/softhsm @@ -538,8 +416,8 @@ apps: preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh" postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh" - mock-identity-system-go: - namespace: esignet-go-mock + mock-identity-system: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/mock-identity-system @@ -547,9 +425,9 @@ apps: image.repository: "mosipqa/mock-identity-system" image.tag: "develop" enable_insecure: "false" - extraEnvVarsCM[0]: "softhsm-mock-identity-system-go-share" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" + extraEnvVarsCM[0]: "softhsm-mock-identity-system-share" + domainConfig.MOSIP_ESIGNET_HOST: "esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" @@ -569,7 +447,7 @@ apps: extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" - extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.name: "softhsm-mock-identity-system-go" + extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.name: "softhsm-mock-identity-system" extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.hsm_local_dir_name: "hsm-client" extraEnvVars.MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: 'individualId\,password' @@ -587,19 +465,19 @@ apps: # --------------------------------------------------------------------------- # Mock Relying Party (Optional) # --------------------------------------------------------------------------- - mock-relying-party-service-go: - namespace: esignet-go-mock + mock-relying-party-service: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go.${domain_name}/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}" - mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go.${domain_name}/v1/esignet/oauth2/par" - mock_relying_party_service.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" - mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go.${domain_name}" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" @@ -621,53 +499,19 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" - mock-relying-party-service-go-mosipid1: - namespace: esignet-go-mosipid1 + mock-relying-party-service-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service - set: - image.repository: "mosipqa/mock-relying-party-service" - image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" - mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth2/par" - mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" - mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" - enable_insecure: "false" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" - extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" - extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" - extraEnvVars.DISPLAY: "page" - extraEnvVars.GRANT_TYPE: "authorization_code" - extraEnvVars.CLAIMS_LOCALES: "en" - extraEnvVars.SCOPE_USER_PROFILE: "openid profile" - extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' - mock_relying_party_service.host: "" - mock_relying_party_service.mountDir: "" - mock_relying_party_service.healthCheckUrl: null - mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" - mock_relying_party_service.puburl: null - mock_relying_party_service.privurl: null - mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" - timeout: 480 - priority: -10 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh" - - mock-relying-party-service-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" - mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth2/par" - mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" - mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-mosipid.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-mosipid.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-mosipid.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" @@ -687,21 +531,21 @@ apps: timeout: 480 priority: -10 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh" - mock-relying-party-service-go-sunbird: - namespace: esignet-go-sunbird + mock-relying-party-service-sunbird: + namespace: esignet-sunbird enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}" - mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth2/par" - mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" - mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-sunbird.${domain_name}" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-sunbird.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-sunbird.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-sunbird.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-sunbird.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" @@ -723,21 +567,21 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh" - mock-relying-party-ui-go: - namespace: esignet-go-mock + mock-relying-party-ui: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go.esignet-go-mock" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service.esignet-mock" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js" mock_relying_party_ui.mock_relying_party_ui_port: '5000' mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet @@ -752,28 +596,28 @@ apps: mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-go.${domain_name}" + istio.hosts[0]: "healthservices.${domain_name}" wait: true timeout: 480 priority: -9 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh" - mock-relying-party-ui-go-mosipid1: - namespace: esignet-go-mosipid1 + mock-relying-party-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-mosipid1.esignet-go-mosipid1" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-mosipid1.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid1.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid.esignet-mosipid" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid.${domain_name}/plugins/sign-in-button-plugin.js" mock_relying_party_ui.mock_relying_party_ui_port: '5000' mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet @@ -788,64 +632,28 @@ apps: mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-go-mosipid1.${domain_name}" + istio.hosts[0]: "healthservices-mosipid.${domain_name}" wait: true timeout: 480 priority: -9 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh" - mock-relying-party-ui-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-ui - set: - image.repository: "mosipqa/mock-relying-party-ui" - image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-mosipid2.esignet-go-mosipid2" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-mosipid2.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid2.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" - mock_relying_party_ui.mock_relying_party_ui_port: '5000' - mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ - mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet - mock_relying_party_ui.DISPLAY: page - mock_relying_party_ui.PROMPT: consent - mock_relying_party_ui.GRANT_TYPE: authorization_code - mock_relying_party_ui.CLAIMS_LOCALES: en - mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile - mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' - mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' - mock_relying_party_ui.DEFAULT_LANG: en - mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' - mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize - mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-go-mosipid2.${domain_name}" - wait: true - timeout: 480 - priority: -9 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh" - - mock-relying-party-ui-go-sunbird: - namespace: esignet-go-sunbird + mock-relying-party-ui-sunbird: + namespace: esignet-sunbird enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-sunbird.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-sunbird.esignet-go-sunbird" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-sunbird.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-sunbird.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-sunbird.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-sunbird.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-sunbird.esignet-sunbird" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-sunbird.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-sunbird.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" mock_relying_party_ui.mock_relying_party_ui_port: '5000' mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet @@ -860,74 +668,42 @@ apps: mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-go-sunbird.${domain_name}" + istio.hosts[0]: "healthservices-sunbird.${domain_name}" wait: true timeout: 480 priority: -9 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-go-mosipid1: - namespace: esignet-go-mosipid1 - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid1.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh" - - pms-policy-go-mosipid1: - namespace: esignet-go-mosipid1 - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid1.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" - priority: -9 - timeout: 1200 - - pms-partner-go-mosipid2: - namespace: esignet-go-mosipid2 + pms-partner-mosipid: + namespace: esignet-mosipid enabled: false version: 12.2.3 chart: mosip/pms-partner set: # image.repository: "mosipid/partner-management-service" # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid2.${domain_name}" + istio.gateways[0]: "pms-partner-mosipid-gateway" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" + extraEnvVarsCM[1]: "esignet-config-server-share" priority: -9 timeout: 1200 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh" - pms-policy-go-mosipid2: - namespace: esignet-go-mosipid2 + pms-policy-mosipid: + namespace: esignet-mosipid enabled: false version: 12.2.3 chart: mosip/pms-policy set: # image.repository: "mosipid/policy-management-service" # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid2-gateway" + istio.gateways[0]: "pms-partner-mosipid-gateway" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid2.${domain_name}" + extraEnvVarsCM[1]: "esignet-config-server-share" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" priority: -9 timeout: 1200 @@ -942,8 +718,8 @@ apps: # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. # After completion, restarts the esignet deployment to pick up the new MISP license key. - esignet-misp-onboarder-go: - namespace: esignet-go-mock + esignet-misp-onboarder: + namespace: esignet-mock enabled: false version: 0.0.1-develop chart: mosip/partner-onboarder @@ -955,7 +731,7 @@ apps: onboarding.configmaps.s3.s3-region: "" onboarding.configmaps.s3.s3-bucket-name: "onboarder" onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-go-mock" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.push_reports_to_s3: "true" onboarding.variables.mosipid: "false" extraEnvVarsCM[0]: "keycloak-env-vars" @@ -964,7 +740,7 @@ apps: extraEnvVarsSecret[1]: "keycloak-client-secrets" domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" domainConfig.mosip-api-host: "api.${domain_name}" - domainConfig.mosip-esignet-host: "esignet-go.${domain_name}" + domainConfig.mosip-esignet-host: "esignet.${domain_name}" domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" domainConfig.mosip-resident-host: "resident.${domain_name}" domainConfig.installation-domain: "${domain_name}" @@ -981,8 +757,8 @@ apps: # Mock RP OIDC Partner Onboarder # Onboards the mock relying party as an OIDC client. # Enable for plugin 1 (mock) or plugin 3 (sunbird-rc). Set mosipid: "true" for mosip-identity-plugin. - esignet-mock-rp-onboarder-go: - namespace: esignet-go-mock + esignet-mock-rp-onboarder: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/partner-onboarder @@ -996,14 +772,14 @@ apps: onboarding.configmaps.s3.s3-region: "" onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" onboarding.configmaps.s3.s3-bucket-name: "onboarder" - onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-go-mock" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.mosipid: "false" onboarding.variables.push_reports_to_s3: "true" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host" domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" domainConfig.mosip-api-host: "api.${domain_name}" - domainConfig.mosip-esignet-host: "esignet-go.${domain_name}" + domainConfig.mosip-esignet-host: "esignet.${domain_name}" domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" domainConfig.mosip-resident-host: "resident.${domain_name}" domainConfig.installation-domain: "${domain_name}" diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml index 1139c2973..dc2f0a5e4 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml @@ -35,11 +35,11 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm namespaces: - signup-go: + signup: protected: false - kernel-go: + kernel: protected: false - mock-smtp-go: + mock-smtp: protected: false apps: @@ -48,8 +48,8 @@ apps: # --------------------------------------------------------------------------- # Creates mosip-signup-client with required roles in Keycloak. # Propagates mosip_signup_client_secret between keycloak and signup namespaces. - signup-keycloak-init-go: - namespace: signup-go + signup-keycloak-init: + namespace: signup enabled: false version: 12.0.2 chart: mosip/keycloak-init @@ -73,8 +73,8 @@ apps: # Required for audit logging (auditmanager), OTP generation (otpmanager), # auth token validation (authmanager), and email/SMS dispatch (notifier). # kernel-preinstall.sh creates kernel namespace and domain-config configmap. - authmanager-go: - namespace: kernel-go + authmanager: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/authmanager @@ -87,8 +87,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - auditmanager-go: - namespace: kernel-go + auditmanager: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/auditmanager @@ -101,8 +101,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - otpmanager-go: - namespace: kernel-go + otpmanager: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/otpmanager @@ -113,8 +113,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - notifier-go: - namespace: kernel-go + notifier: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/notifier @@ -128,8 +128,8 @@ apps: # --------------------------------------------------------------------------- # Mock SMTP (Optional — dev/test email and SMS) # --------------------------------------------------------------------------- - mock-smtp-go: - namespace: mock-smtp-go + mock-smtp: + namespace: mock-smtp enabled: false version: 1.0.0 chart: mosip/mock-smtp @@ -145,8 +145,8 @@ apps: # signup-service-preinstall.sh copies redis secrets, creates keycloak-host # configmap, signup-captcha and signup-keystore secrets, and msg-gateway # configmap/secret pointing to mock-smtp. - signup-go: - namespace: signup-go + signup: + namespace: signup enabled: false version: 1.2.2 chart: mosip/signup @@ -155,8 +155,8 @@ apps: image.tag: "1.2.2" enable_insecure: "false" plugin_name_env: "esignet-mock-plugin.jar" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" wait: true timeout: 600 @@ -168,18 +168,18 @@ apps: # --------------------------------------------------------------------------- # Signup UI # --------------------------------------------------------------------------- - signup-ui-go: - namespace: signup-go + signup-ui: + namespace: signup enabled: false version: 1.2.2 chart: mosip/signup-ui set: image.repository: "mosipid/signup-ui" image.tag: "1.2.2" - istio.hosts[0]: "signup-go.${domain_name}" - signup_ui.signup_service_host: "signup-go.signup-go" - signup_ui.configmaps.signup-ui.REACT_APP_API_BASE_URL: "http://signup-go.signup-go/v1/signup" - signup_ui.configmaps.signup-ui.REACT_APP_SBI_DOMAIN_URI: "http://signup-go.signup-go" + istio.hosts[0]: "signup.${domain_name}" + signup_ui.signup_service_host: "signup.signup" + signup_ui.configmaps.signup-ui.REACT_APP_API_BASE_URL: "http://signup.signup/v1/signup" + signup_ui.configmaps.signup-ui.REACT_APP_SBI_DOMAIN_URI: "http://signup.signup" wait: true timeout: 600 priority: -3 diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index b48741524..94ca20929 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -8,32 +8,29 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): -# esignet-apitestrig-go → esignet-go-mock ns -# esignet-go-mosipid1-apitestrig → esignet-go-mosipid1 ns -# esignet-go-mosipid2-apitestrig → esignet-go-mosipid2 ns -# esignet-go-sunbird-apitestrig → esignet-go-sunbird ns -# esignet-signup-apitestrig-go → signup-go ns (disabled — enable if signup deployed) -# signup-uitestrig-go → signup-uitestrig-go (disabled — enable if signup deployed) +# esignet-apitestrig → esignet-mock ns +# esignet-mosipid-apitestrig → esignet-mosipid ns +# esignet-sunbird-apitestrig → esignet-sunbird ns +# esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) +# signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) namespaces: - esignet-go-mosipid1: + esignet-mock: protected: false - esignet-go-mock: + esignet-mosipid: protected: false - esignet-go-mosipid2: + esignet-sunbird: protected: false - esignet-go-sunbird: + signup: protected: false - signup-go: - protected: false - signup-uitestrig-go: + signup-uitestrig: protected: false apps: # --------------------------------------------------------------------------- # eSignet API Testrig — main esignet namespace # --------------------------------------------------------------------------- - esignet-apitestrig-go: - namespace: esignet-go-mock + esignet-apitestrig: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -61,12 +58,12 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-mock" + apitestrig.configmaps.apitestrig.NS: "esignet-mock" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" @@ -75,10 +72,10 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh" # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid1 namespace (mosip-identity-plugin) + # eSignet API Testrig — esignet-mosipid namespace (mosip-identity-plugin) # --------------------------------------------------------------------------- - esignet-go-mosipid1-apitestrig: - namespace: esignet-go-mosipid1 + esignet-mosipid-apitestrig: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -89,61 +86,15 @@ apps: extraEnvVarsCM[2]: "keycloak-host" extraEnvVarsCM[3]: "db" extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid1-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid1-apitestrig" - extraEnvVarsSecret[2]: "keycloak-client-secrets" - extraEnvVarsSecret[3]: "postgres-postgresql" - crontime: "0 2 * * *" - apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' - apitestrig.configmaps.s3.s3-user-key: 'admin' - apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid1_domain_name}" - apitestrig.configmaps.db.db-su-user: "postgres" - apitestrig.configmaps.db.db-port: "${esignet_db_port}" - apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" - apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" - apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" - apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" - apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" - apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-mosipid1" - apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' - apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-mosipid1.${domain_name}" - apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid1_domain_name};idrepository=api-internal.${mosipid1_domain_name};authmanager=api-internal.${mosipid1_domain_name};resident=api-internal.${mosipid1_domain_name};partnermanager=pms-go-mosipid1.${mosipid1_domain_name};idauthentication=api-internal.${mosipid1_domain_name};masterdata=api-internal.${mosipid1_domain_name};idgenerator=api-internal.${mosipid1_domain_name};policymanager=pms-go-mosipid1.${mosipid1_domain_name};preregistration=api-internal.${mosipid1_domain_name};keymanager=api-internal.${mosipid1_domain_name};" - secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - apitestrig.variables.push_reports_to_s3: "yes" - priority: -4 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh" - - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid2 namespace (mosip-identity-plugin) - # --------------------------------------------------------------------------- - esignet-go-mosipid2-apitestrig: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/apitestrig - valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" - set: - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "s3" - extraEnvVarsCM[2]: "keycloak-host" - extraEnvVarsCM[3]: "db" - extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid2-apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-mosipid-apitestrig" extraEnvVarsSecret[2]: "keycloak-client-secrets" extraEnvVarsSecret[3]: "postgres-postgresql" crontime: "0 2 * * *" apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' apitestrig.configmaps.s3.s3-user-key: 'admin' apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid2_domain_name}" + apitestrig.configmaps.db.db-server: "api-internal.${mosipid_domain_name}" apitestrig.configmaps.db.db-su-user: "postgres" apitestrig.configmaps.db.db-port: "${esignet_db_port}" apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" @@ -152,26 +103,26 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-mosipid2" + apitestrig.configmaps.apitestrig.NS: "esignet-mosipid" apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-mosipid2.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid2_domain_name};idrepository=api-internal.${mosipid2_domain_name};authmanager=api-internal.${mosipid2_domain_name};resident=api-internal.${mosipid2_domain_name};partnermanager=pms-go-mosipid2.${mosipid2_domain_name};idauthentication=api-internal.${mosipid2_domain_name};masterdata=api-internal.${mosipid2_domain_name};idgenerator=api-internal.${mosipid2_domain_name};policymanager=pms-go-mosipid2.${mosipid2_domain_name};preregistration=api-internal.${mosipid2_domain_name};keymanager=api-internal.${mosipid2_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};partnermanager=pms-mosipid.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};policymanager=pms-mosipid.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -3 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh" # --------------------------------------------------------------------------- # eSignet API Testrig — esignet-sunbird namespace (sunbird-rc-plugin) # postInstall triggers all four testrig namespaces after last one deploys. # --------------------------------------------------------------------------- - esignet-go-sunbird-apitestrig: - namespace: esignet-go-sunbird + esignet-sunbird-apitestrig: + namespace: esignet-sunbird enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -199,14 +150,14 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-sunbird" + apitestrig.configmaps.apitestrig.NS: "esignet-sunbird" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-sunbird.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-sunbird.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid1_domain_name}" + apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid_domain_name}" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -2 @@ -218,8 +169,8 @@ apps: # Signup API Test Rig — disabled by default # Enable only if signup stack (signup-dsf) is deployed. # --------------------------------------------------------------------------- - esignet-signup-apitestrig-go: - namespace: signup-go + esignet-signup-apitestrig: + namespace: signup enabled: false version: 0.0.1-develop chart: mosip/apitestrig @@ -238,7 +189,7 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "signup-go" + apitestrig.configmaps.apitestrig.NS: "signup" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" @@ -250,8 +201,8 @@ apps: # Signup UI Test Rig — disabled by default # Enable only if signup stack (signup-dsf) is deployed. # --------------------------------------------------------------------------- - signup-uitestrig-go: - namespace: signup-uitestrig-go + signup-uitestrig: + namespace: signup-uitestrig enabled: false version: 0.0.1-develop chart: mosip/uitestrig @@ -269,7 +220,7 @@ apps: uitestrig.configmaps.uitestrig.reportExpirationInDays: "3" uitestrig.configmaps.uitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" uitestrig.configmaps.uitestrig.eSignetDeployed: "yes" - uitestrig.configmaps.uitestrig.NS: "signup-uitestrig-go" + uitestrig.configmaps.uitestrig.NS: "signup-uitestrig" uitestrig.variables.push_reports_to_s3: "yes" priority: -1 hooks: diff --git a/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml index 45598cc92..7ad1685a5 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml @@ -96,21 +96,21 @@ envVariables: - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_SOFTHSM_ESIGNET_SECURITY_PIN valueFrom: secretKeyRef: - name: esignet-softhsm-go + name: esignet-softhsm key: security-pin enabled: true - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ESIGNET_CAPTCHA_SECRET_KEY valueFrom: secretKeyRef: - name: esignet-captcha-go + name: esignet-captcha key: esignet-captcha-secret-key enabled: true - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ESIGNET_CAPTCHA_SITE_KEY valueFrom: secretKeyRef: - name: esignet-captcha-go + name: esignet-captcha key: esignet-captcha-site-key enabled: true diff --git a/Helmsman/utils/softhsm-esignet-mosipid1-values.yaml b/Helmsman/utils/softhsm-esignet-mosipid-values.yaml similarity index 90% rename from Helmsman/utils/softhsm-esignet-mosipid1-values.yaml rename to Helmsman/utils/softhsm-esignet-mosipid-values.yaml index 526bf77c7..0354bf98d 100644 --- a/Helmsman/utils/softhsm-esignet-mosipid1-values.yaml +++ b/Helmsman/utils/softhsm-esignet-mosipid-values.yaml @@ -1,4 +1,4 @@ -# SoftHSM values for esignet-mosipid1 namespace +# SoftHSM values for esignet-mosipid namespace # Identical to softhsm-esignet-values.yaml — separate file so each namespace # gets an independent SoftHSM PVC and pin secret. diff --git a/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml b/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml deleted file mode 100644 index 7df046d37..000000000 --- a/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# SoftHSM values for esignet-mosipid2 namespace -# Identical to softhsm-esignet-values.yaml — separate file so each namespace -# gets an independent SoftHSM PVC and pin secret. - -replicaCount: 1 - -image: - repository: mosipid/softhsm - tag: v2 - pullPolicy: Always - -persistence: - enabled: true - size: 1Gi - storageClass: "" - -resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - -securityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 From 21e4675a1dadc2150d840c4215ef3e79bb4a8972 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 15:23:09 +0530 Subject: [PATCH 049/127] Drop -go suffix and consolidate mosipid1/mosipid2 in esignet-standalone-2.0.0 hooks Updates namespace/secret/configmap names and kubectl patches in all hook scripts to match the DSF rename, removes the 7 mosipid1-only scripts (superseded by the consolidated mosipid instance), and deletes 2 dead scripts that duplicated the shared external-dsf.yaml's own hooks and were never referenced by any DSF file. Also adds explicit cleanup of stale pre-rename captcha env var names on the shared captcha Deployment (captcha-postinstall.sh, esignet-mosipid-preinstall.sh, esignet-sunbird-preinstall.sh), so renaming the underlying secrets doesn't leave orphaned env vars pointing at secrets that no longer exist. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- ...sh => apitestrig-esignet-mosipid-setup.sh} | 22 +-- .../apitestrig-esignet-mosipid2-setup.sh | 39 ----- .../apitestrig-esignet-setup.sh | 4 +- .../apitestrig-esignet-sunbird-setup.sh | 4 +- .../apitestrig-signup-setup.sh | 2 +- .../captcha-postinstall.sh | 34 ++-- .../config-server-esignet-postinstall.sh | 28 ++-- .../config-server-esignet-setup.sh | 6 +- .../esignet-db-postinstall.sh | 23 --- .../esignet-init-db.sh | 24 --- .../esignet-misp-onboarder-postinstall.sh | 22 +-- .../esignet-misp-onboarder-preinstall.sh | 2 +- .../esignet-mock-rp-onboarder-postinstall.sh | 18 +-- .../esignet-mock-rp-onboarder-preinstall.sh | 2 +- ...stall.sh => esignet-mosipid-preinstall.sh} | 95 ++++++----- .../esignet-mosipid1-preinstall.sh | 150 ------------------ .../esignet-postinstall-keycloak-init.sh | 8 +- .../esignet-preinstall.sh | 8 +- .../esignet-sunbird-preinstall.sh | 37 +++-- .../kafka-postinstall.sh | 2 +- .../kernel-preinstall.sh | 2 +- .../keycloak-postinstall.sh | 2 +- .../mock-identity-init-db.sh | 4 +- .../mock-identity-system-preinstall.sh | 24 +-- ...lying-party-service-mosipid-preinstall.sh} | 6 +- ...lying-party-service-mosipid2-preinstall.sh | 10 -- .../mock-relying-party-service-preinstall.sh | 2 +- ...elying-party-service-sunbird-preinstall.sh | 2 +- ...ck-relying-party-ui-mosipid-preinstall.sh} | 14 +- ...ck-relying-party-ui-mosipid2-preinstall.sh | 24 --- .../mock-relying-party-ui-preinstall.sh | 4 +- ...ock-relying-party-ui-sunbird-preinstall.sh | 4 +- .../notifier-postinstall.sh | 6 +- ...stall.sh => oidc-ui-mosipid-preinstall.sh} | 6 +- .../oidc-ui-mosipid1-preinstall.sh | 9 -- .../oidc-ui-preinstall.sh | 2 +- .../oidc-ui-sunbird-preinstall.sh | 2 +- ...l.sh => pms-partner-mosipid-preinstall.sh} | 20 +-- .../pms-partner-mosipid1-preinstall.sh | 45 ------ .../postgres-preinstall.sh | 2 +- .../esignet-standalone-2.0.0/redis-setup.sh | 2 +- .../signup-init-db.sh | 2 +- .../signup-keycloak-init-postinstall.sh | 2 +- .../signup-keycloak-init-preinstall.sh | 2 +- .../signup-service-preinstall.sh | 26 +-- ...up.sh => softhsm-esignet-mosipid-setup.sh} | 6 +- .../softhsm-esignet-mosipid2-setup.sh | 9 -- .../softhsm-esignet-postinstall.sh | 16 +- .../softhsm-esignet-setup.sh | 2 +- .../softhsm-esignet-sunbird-setup.sh | 2 +- ...ofthsm-mock-identity-system-postinstall.sh | 12 +- ...softhsm-mock-identity-system-preinstall.sh | 4 +- .../trigger-test-jobs-esignet.sh | 29 ++-- .../uitestrig-signup-setup.sh | 4 +- 54 files changed, 269 insertions(+), 569 deletions(-) rename Helmsman/hooks/esignet-standalone-2.0.0/{apitestrig-esignet-mosipid1-setup.sh => apitestrig-esignet-mosipid-setup.sh} (68%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{esignet-mosipid2-preinstall.sh => esignet-mosipid-preinstall.sh} (53%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{mock-relying-party-service-mosipid1-preinstall.sh => mock-relying-party-service-mosipid-preinstall.sh} (68%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{mock-relying-party-ui-mosipid1-preinstall.sh => mock-relying-party-ui-mosipid-preinstall.sh} (57%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{oidc-ui-mosipid2-preinstall.sh => oidc-ui-mosipid-preinstall.sh} (66%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{pms-partner-mosipid2-preinstall.sh => pms-partner-mosipid-preinstall.sh} (61%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{softhsm-esignet-mosipid1-setup.sh => softhsm-esignet-mosipid-setup.sh} (65%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh similarity index 68% rename from Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh index 14b70b216..085a41dfb 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh @@ -1,22 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-MOSIPID API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid1 namespace for the esignet-go-mosipid1-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 +# Prepares the esignet-mosipid namespace for the esignet-mosipid-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid # (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, -# and the s3-esignet-mosipid1-apitestrig / apitestrig-esignet-mosipid1-apitestrig +# and the s3-esignet-mosipid-apitestrig / apitestrig-esignet-mosipid-apitestrig # secrets referenced by extraEnvVarsSecret are created here (chart doesn't create # them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail -NS=esignet-go-mosipid1 +NS=esignet-mosipid COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -24,16 +24,16 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig -echo "Creating s3-esignet-mosipid1-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic s3-esignet-mosipid1-apitestrig \ +echo "Creating s3-esignet-mosipid-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-mosipid-apitestrig \ --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Creating apitestrig-esignet-mosipid1-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid1-apitestrig \ +echo "Creating apitestrig-esignet-mosipid-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid-apitestrig \ --dry-run=client -o yaml | kubectl apply -f - echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" -echo "eSignet-MOSIPID1 API Testrig pre-install setup completed." +echo "eSignet-MOSIPID API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh deleted file mode 100755 index 072faec92..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install Setup -# ============================================================================= -# Prepares the esignet-mosipid2 namespace for the esignet-go-mosipid2-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 -# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, -# and the s3-esignet-mosipid2-apitestrig / apitestrig-esignet-mosipid2-apitestrig -# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create -# them itself); stale testrig CMs are deleted so the chart recreates them. -# ============================================================================= -set -euo pipefail - -NS=esignet-go-mosipid2 -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" - -echo "================================================" -echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install" -echo "================================================" - -echo "Deleting stale testrig configmaps in $NS" -kubectl -n "$NS" delete --ignore-not-found=true configmap s3 -kubectl -n "$NS" delete --ignore-not-found=true configmap db -kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig - -echo "Creating s3-esignet-mosipid2-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic s3-esignet-mosipid2-apitestrig \ - --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Creating apitestrig-esignet-mosipid2-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid2-apitestrig \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying postgres-postgresql secret to $NS" -$COPY_UTIL secret postgres-postgresql postgres "$NS" - -echo "eSignet-MOSIPID2 API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh index ebd79e8e9..b44bfdeae 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh @@ -2,7 +2,7 @@ # ============================================================================= # eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mock namespace for the esignet-apitestrig-go release. +# Prepares the esignet-mock namespace for the esignet-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-mock ns # (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, # and the s3-esignet-apitestrig / apitestrig-esignet-apitestrig secrets referenced @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -NS=esignet-go-mock +NS=esignet-mock COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh index d7adbcca9..ca432b01c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh @@ -2,7 +2,7 @@ # ============================================================================= # eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-sunbird namespace for the esignet-go-sunbird-apitestrig release. +# Prepares the esignet-sunbird namespace for the esignet-sunbird-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-sunbird # (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, # and the s3-esignet-sunbird-apitestrig / apitestrig-esignet-sunbird-apitestrig @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -NS=esignet-go-sunbird +NS=esignet-sunbird COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh index f66a44b22..d03208a1e 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh @@ -9,7 +9,7 @@ # ============================================================================= set -euo pipefail -NS=signup-go +NS=signup COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh index 60ef72d59..a6e42e923 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh @@ -9,11 +9,11 @@ # Environment Variables: # ESIGNET_CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) # ESIGNET_CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) -# ESIGNET_NS - eSignet namespace (default: esignet-go-mock) +# ESIGNET_NS - eSignet namespace (default: esignet-mock) # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" CAPTCHA_NS="captcha" CAPTCHA_SITE_KEY="${ESIGNET_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_CAPTCHA_SITE_KEY environment variable must be set}" CAPTCHA_SECRET_KEY="${ESIGNET_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_CAPTCHA_SECRET_KEY environment variable must be set}" @@ -24,22 +24,36 @@ echo "eSignet 1.7.1 - Captcha Post-install" echo "================================================" # --- Step 1: Create captcha secrets for eSignet --- -echo "Creating esignet-captcha-go secret in $ESIGNET_NS namespace" -kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha-go \ +echo "Creating esignet-captcha secret in $ESIGNET_NS namespace" +kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - # --- Step 2: Copy captcha secret to captcha namespace --- -echo "Copying esignet-captcha-go secret to $CAPTCHA_NS namespace" -$COPY_UTIL secret esignet-captcha-go "$ESIGNET_NS" "$CAPTCHA_NS" +echo "Copying esignet-captcha secret to $CAPTCHA_NS namespace" +$COPY_UTIL secret esignet-captcha "$ESIGNET_NS" "$CAPTCHA_NS" # --- Step 3: Patch captcha deployment with secret env var --- echo "Patching captcha deployment with secret key environment variable" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO')].name}" 2>/dev/null || echo "") + +# Remove the old pre-rename env var name if still present, so it doesn't linger +# pointing at a secret that no longer exists (esignet-captcha-go was renamed to +# esignet-captcha). +OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO" | cut -d: -f1 || echo "") +if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" +fi + +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then - echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var..." + echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var..." ENV_ARRAY_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ -o jsonpath="{.spec.template.spec.containers[0].env}" 2>/dev/null || echo "") if [[ -z "$ENV_ARRAY_EXISTS" ]]; then @@ -48,9 +62,9 @@ if [[ -z "$ENV_VAR_EXISTS" ]]; then -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env", "value": []}]' fi kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var already exists." fi echo "Captcha post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh index 165989433..23d740745 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh @@ -1,39 +1,33 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Config-Server eSignet Post-install +# eSignet 2.0.0 (Go) - Config-Server eSignet Post-install # ============================================================================= -# Copies esignet-config-server-share CM from esignet-mock ns to mosipid1/mosipid2/sunbird, +# Copies esignet-config-server-share CM from esignet-mock ns to mosipid/sunbird, # then patches active_profile_env and spring_config_label_env per namespace # so each instance points to the correct config server profile and Git label. # # Environment variables (set in GitHub Actions workflow): -# ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL - Git label for esignet-mosipid1 (default: develop) -# ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL - Git label for esignet-mosipid2 (default: develop) +# ESIGNET_MOSIPID_SPRING_CONFIG_LABEL - Git label for esignet-mosipid (default: develop) # ============================================================================= set -euo pipefail -SOURCE_NS="esignet-go-mock" +SOURCE_NS="esignet-mock" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CM_NAME="esignet-config-server-go-share" +CM_NAME="esignet-config-server-share" -MOSIPID1_SPRING_LABEL="${ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL:-develop}" -MOSIPID2_SPRING_LABEL="${ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL:-develop}" +MOSIPID_SPRING_LABEL="${ESIGNET_MOSIPID_SPRING_CONFIG_LABEL:-develop}" echo "================================================" -echo "eSignet 1.7.1 - Config-Server eSignet Post-install" +echo "eSignet 2.0.0 (Go) - Config-Server eSignet Post-install" echo "================================================" -for TARGET_NS in esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do +for TARGET_NS in esignet-mosipid esignet-sunbird; do echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" done -echo "Patching $CM_NAME in esignet-go-mosipid1 (active_profile_env=mosipid1, spring_config_label_env=$MOSIPID1_SPRING_LABEL)" -kubectl -n esignet-go-mosipid1 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid1\",\"spring_config_label_env\":\"$MOSIPID1_SPRING_LABEL\"}}" - -echo "Patching $CM_NAME in esignet-go-mosipid2 (active_profile_env=mosipid2, spring_config_label_env=$MOSIPID2_SPRING_LABEL)" -kubectl -n esignet-go-mosipid2 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid2\",\"spring_config_label_env\":\"$MOSIPID2_SPRING_LABEL\"}}" +echo "Patching $CM_NAME in esignet-mosipid (active_profile_env=mosipid, spring_config_label_env=$MOSIPID_SPRING_LABEL)" +kubectl -n esignet-mosipid patch configmap "$CM_NAME" --type merge \ + -p "{\"data\":{\"active_profile_env\":\"mosipid\",\"spring_config_label_env\":\"$MOSIPID_SPRING_LABEL\"}}" echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh index b2e028f2c..ee1798d92 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh @@ -29,7 +29,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" @@ -54,11 +54,11 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go.${domain_name}" \ + --from-literal=mosip-signup-host="signup.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh deleted file mode 100755 index 27b7e4a3d..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Database Init Post-install (postgres-init-esignet-mock) -# ============================================================================= -# postgres-init-esignet-mock runs in the postgres namespace and creates -# db-common-secrets there. This hook copies it to all esignet-mock namespaces -# so each eSignet instance can use it for DB connections. -# ============================================================================= -set -euo pipefail - -POSTGRES_NS="postgres" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - Database Init Post-install" -echo "================================================" - -for NS in esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do - echo "Copying db-common-secrets from $POSTGRES_NS to $NS" - $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$NS" -done - -echo "Database init post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh deleted file mode 100755 index c597726bc..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Database Init Pre-install (postgres-init-esignet-mock) -# ============================================================================= -# Based on: deploy/postgres/postgres-init.sh -# postgres-init-esignet-mock runs in the postgres namespace so it can access -# postgres-postgresql secret natively. This hook pre-creates all esignet-mock -# namespaces so the postInstall hook can copy db-common-secrets into each. -# Namespaces are created here at priority -16 because the namespace-specific -# preinstall hooks (esignet-mosipid1/mosipid2/sunbird) only run at priority -14. -# ============================================================================= -set -euo pipefail - -echo "================================================" -echo "eSignet 1.7.1 - Database Init Pre-install" -echo "================================================" - -for NS in esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do - kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - - kubectl label namespace "$NS" istio-injection=enabled --overwrite - echo "Namespace $NS ready." -done - -echo "Database init pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index f26e8ed56..c6b88a7b2 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -8,14 +8,14 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - MISP Onboarder Post-install" echo "================================================" JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ - -l app.kubernetes.io/instance=esignet-misp-onboarder-go \ + -l app.kubernetes.io/instance=esignet-misp-onboarder \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") # Always restore namespace injection before returning from this hook. @@ -24,24 +24,24 @@ echo "Istio injection re-enabled on namespace $ESIGNET_NS." if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then echo "WARNING: onboarding job may not have completed. Check logs:" - kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder-go --tail=30 2>/dev/null || true + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder --tail=30 2>/dev/null || true exit 1 fi echo "eSignet MISP partner onboarding completed successfully." # Restart config-server first so it reloads the MISP key from the secret, # then restart esignet so it fetches the updated config from config-server. -if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server-go &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server-go - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s - echo "esignet-config-server-go restarted." +if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server --timeout=300s + echo "esignet-config-server restarted." else - echo "esignet-config-server-go deployment not found — skipping restart." + echo "esignet-config-server deployment not found — skipping restart." fi -if kubectl -n "$ESIGNET_NS" get deployment esignet-go-mock &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-go-mock - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s +if kubectl -n "$ESIGNET_NS" get deployment esignet-mock &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-mock + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-mock --timeout=300s echo "esignet deployment restarted." else echo "esignet deployment not found — skipping restart." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh index e8dc9d7e8..a4feb8aa1 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -12,7 +12,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh index 18f4d4708..43204af80 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh @@ -7,21 +7,21 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - Mock RP Onboarder Post-install" echo "================================================" JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ - -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-go \ + -l app.kubernetes.io/instance=esignet-mock-rp-onboarder \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") if [ "$JOB_STATUS" = "1" ]; then echo "Mock RP OIDC partner onboarding completed successfully." else echo "WARNING: onboarding job may not have completed. Check logs:" - kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-go --tail=30 2>/dev/null || true + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-mock-rp-onboarder --tail=30 2>/dev/null || true fi # Re-enable Istio sidecar injection now that the Job has completed @@ -29,13 +29,13 @@ kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite echo "Istio injection re-enabled on namespace $ESIGNET_NS." # Restart mock-relying-party-service so it picks up the newly onboarded OIDC client -if kubectl -n "$ESIGNET_NS" get deployment mock-relying-party-service-go &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment mock-relying-party-service-go - kubectl -n "$ESIGNET_NS" rollout status deployment mock-relying-party-service-go --timeout=300s || \ - echo "WARNING: mock-relying-party-service-go rollout did not complete within timeout." >&2 - echo "mock-relying-party-service-go restarted." +if kubectl -n "$ESIGNET_NS" get deployment mock-relying-party-service &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment mock-relying-party-service + kubectl -n "$ESIGNET_NS" rollout status deployment mock-relying-party-service --timeout=300s || \ + echo "WARNING: mock-relying-party-service rollout did not complete within timeout." >&2 + echo "mock-relying-party-service restarted." else - echo "mock-relying-party-service-go deployment not found — skipping restart." + echo "mock-relying-party-service deployment not found — skipping restart." fi echo "Mock RP onboarder post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh index 14d494299..3cf764670 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh @@ -7,7 +7,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh similarity index 53% rename from Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh index e9346235e..92b506c9e 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh @@ -1,41 +1,41 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID2 Service Pre-install +# eSignet 1.7.1 - eSignet MOSIPID Service Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-go-mosipid2 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid2, -# and patches the captcha deployment with the MOSIPID2 secret key. +# Wrapper: sets ESIGNET_NS=esignet-mosipid, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-mosipid secret +# in the captcha namespace from workflow env vars, copies it to esignet-mosipid, +# and patches the captcha deployment with the MOSIPID secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" +export ESIGNET_NS="esignet-mosipid" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY must be set}" -MOSIPID2_POSTGRES_PASS="${MOSIPID2_POSTGRES_PASSWORD:?ERROR: MOSIPID2_POSTGRES_PASSWORD must be set}" -MOSIPID2_KC_ADMIN_PASS="${MOSIPID2_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID2_KEYCLOAK_ADMIN_PASSWORD must be set}" +CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY must be set}" +MOSIPID_POSTGRES_PASS="${MOSIPID_POSTGRES_PASSWORD:?ERROR: MOSIPID_POSTGRES_PASSWORD must be set}" +MOSIPID_KC_ADMIN_PASS="${MOSIPID_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID_KEYCLOAK_ADMIN_PASSWORD must be set}" "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" -# Create MOSIPID2-specific esignet-global — same domain_name, but esignet/signup hosts differ +# Create MOSIPID-specific esignet-global — same domain_name, but esignet/signup hosts differ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go-mosipid2.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-mosipid.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go-mosipid2.${domain_name}" \ + --from-literal=mosip-signup-host="signup-mosipid.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - -# Override postgres-config with MOSIPID2-specific DB values (2.0.0: isolated database) +# Override postgres-config with MOSIPID-specific DB values (2.0.0: isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_go_mosipid2","database-username":"esignetuser_go_mosipid2"}}' + -p '{"data":{"database-name":"mosip_esignet_mosipid","database-username":"esignetuser_mosipid"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then @@ -44,50 +44,65 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-go-mosipid2 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid2 \ +echo "Creating esignet-captcha-mosipid secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-go-mosipid2 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-go-mosipid2 "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-mosipid secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-mosipid "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETMOSIPID secret key" + +# Remove stale pre-rename/pre-consolidation env var names if still present, so they +# don't linger pointing at secrets that no longer exist. +for OLD_NAME in MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1 MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2; do + OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "$OLD_NAME" | cut -d: -f1 || echo "") + if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale $OLD_NAME env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" + fi +done -echo "Patching captcha deployment with ESIGNETMOSIPID2 secret key" ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-mosipid2", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID already exists." fi -# --- postgres-postgresql-mosipid2 secret (MOSIPID2 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid2 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid2 \ - --from-literal=postgres-password="${MOSIPID2_POSTGRES_PASS}" \ +# --- postgres-postgresql-mosipid secret (MOSIPID remote postgres password) --- +echo "Creating postgres-postgresql-mosipid secret in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid \ + --from-literal=postgres-password="${MOSIPID_POSTGRES_PASS}" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-host-mosipid2 CM (external URL points to MOSIPID2 Keycloak) --- -echo "Creating keycloak-host-mosipid2 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid2 \ - --from-literal=keycloak-external-host="iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid2_domain_name}" \ +# --- keycloak-host-mosipid CM (external URL points to MOSIPID Keycloak) --- +echo "Creating keycloak-host-mosipid configmap in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid \ + --from-literal=keycloak-external-host="iam.${mosipid_domain_name}" \ + --from-literal=keycloak-external-url="https://iam.${mosipid_domain_name}" \ --from-literal=keycloak-internal-host="keycloak.keycloak" \ --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-client-secrets-mosipid2: fetch all confidential clients from MOSIPID2 Keycloak --- -KC_HOST="iam.${mosipid2_domain_name}" +# --- keycloak-client-secrets-mosipid: fetch all confidential clients from MOSIPID Keycloak --- +KC_HOST="iam.${mosipid_domain_name}" REALM="mosip" echo "Fetching admin token from $KC_HOST" TOKEN_RESPONSE=$(curl -sf -X POST \ "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID2_KC_ADMIN_PASS}") + -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID_KC_ADMIN_PASS}") ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 @@ -116,12 +131,12 @@ while IFS= read -r client_json; do done < <(echo "$CLIENTS" | jq -c '.[]') if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID2 Keycloak" >&2; exit 1 + echo "❌ No client secrets fetched from MOSIPID Keycloak" >&2; exit 1 fi -echo "Creating keycloak-client-secrets-mosipid2 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid2 \ +echo "Creating keycloak-client-secrets-mosipid in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid \ "${SECRET_ARGS[@]}" \ --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid2 created" +echo "✓ keycloak-client-secrets-mosipid created" -echo "eSignet MOSIPID2 pre-install completed." +echo "eSignet MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh deleted file mode 100755 index cd5501eaf..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ /dev/null @@ -1,150 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID1 Service Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-go-mosipid1 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid1, -# and patches the captcha deployment with the MOSIPID1 secret key. -# ============================================================================= -set -euo pipefail - -export ESIGNET_NS="esignet-go-mosipid1" -CAPTCHA_NS="captcha" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY must be set}" -MOSIPID1_POSTGRES_PASS="${MOSIPID1_POSTGRES_PASSWORD:?ERROR: MOSIPID1_POSTGRES_PASSWORD must be set}" -MOSIPID1_KC_ADMIN_PASS="${MOSIPID1_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID1_KEYCLOAK_ADMIN_PASSWORD must be set}" - -"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" - -# Create MOSIPID1-specific esignet-global — same domain_name, but esignet/signup hosts differ -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go-mosipid1.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go-mosipid1.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - - -# Override postgres-config with MOSIPID1-specific DB values (2.0.0: isolated database) -kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_go_mosipid1","database-username":"esignetuser_go_mosipid1"}}' - -# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" -fi - -# Create esignet-keystore-go-mosipid1 (PKCS12 keystore for KEYMANAGER_KEYSTORE_TYPE: PKCS12) — -# a throwaway self-signed cert generated once and reused across redeploys. Never regenerate an -# existing keystore: KEYMANAGER_PKCS12_PASSWORD/mosipid1.pfx must stay stable, or anything -# encrypted with the old keystore becomes unreadable. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-keystore-go-mosipid1 &>/dev/null; then - echo "Generating dummy PKCS12 keystore for mosipid1" - DUMMY_P12_PASSWORD="localtest" - TMP_KEY="$(mktemp)" - TMP_CERT="$(mktemp)" - TMP_P12="$(mktemp)" - openssl req -x509 -newkey rsa:2048 -keyout "$TMP_KEY" -out "$TMP_CERT" \ - -days 3650 -nodes -subj "/CN=esignet-go-mosipid1-dummy" 2>/dev/null - openssl pkcs12 -export -out "$TMP_P12" -inkey "$TMP_KEY" -in "$TMP_CERT" \ - -passout "pass:${DUMMY_P12_PASSWORD}" - kubectl -n "$ESIGNET_NS" create secret generic esignet-keystore-go-mosipid1 \ - --from-literal=KEYMANAGER_PKCS12_PASSWORD="$DUMMY_P12_PASSWORD" \ - --from-file=mosipid1.pfx="$TMP_P12" - rm -f "$TMP_KEY" "$TMP_CERT" "$TMP_P12" - echo "esignet-keystore-go-mosipid1 secret created in $ESIGNET_NS" -else - echo "esignet-keystore-go-mosipid1 already exists — reusing existing keystore" -fi - -echo "Creating esignet-captcha-go-mosipid1 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid1 \ - --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying esignet-captcha-go-mosipid1 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-go-mosipid1 "$CAPTCHA_NS" "$ESIGNET_NS" - -echo "Patching captcha deployment with ESIGNETMOSIPID1 secret key" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1')].name}" 2>/dev/null || echo "") -if [[ -z "$ENV_VAR_EXISTS" ]]; then - kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-mosipid1", "key": "esignet-captcha-secret-key"}}}}]' -else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1 already exists." -fi - -# --- postgres-postgresql-mosipid1 secret (MOSIPID1 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid1 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid1 \ - --from-literal=postgres-password="${MOSIPID1_POSTGRES_PASS}" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-host-mosipid1 CM (external URL points to MOSIPID1 Keycloak) --- -echo "Creating keycloak-host-mosipid1 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid1 \ - --from-literal=keycloak-external-host="iam.${mosipid1_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid1_domain_name}" \ - --from-literal=keycloak-internal-host="keycloak.keycloak" \ - --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ - --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-client-secrets-mosipid1: fetch all confidential clients from MOSIPID1 Keycloak --- -KC_HOST="iam.${mosipid1_domain_name}" -REALM="mosip" - -echo "Fetching admin token from $KC_HOST" -TOKEN_RESPONSE=$(curl -sf -X POST \ - "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ - -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID1_KC_ADMIN_PASS}") -ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') -if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then - echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 -fi -echo "✓ Admin token obtained" - -echo "Fetching all clients from realm $REALM on $KC_HOST" -CLIENTS=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients?max=500" \ - -H "Authorization: Bearer $ADMIN_TOKEN") - -SECRET_ARGS=() -while IFS= read -r client_json; do - client_id=$(echo "$client_json" | jq -r '.clientId') - uuid=$(echo "$client_json" | jq -r '.id') - auth_type=$(echo "$client_json" | jq -r '.clientAuthenticatorType') - is_public=$(echo "$client_json" | jq -r '.publicClient') - [[ "$auth_type" != "client-secret" || "$is_public" == "true" ]] && continue - secret_val=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients/${uuid}/client-secret" \ - -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.value // empty') - [[ -z "$secret_val" || "$secret_val" == "null" ]] && continue - key=$(echo "$client_id" | tr '-' '_')_secret - SECRET_ARGS+=("--from-literal=${key}=${secret_val}") - echo " ✓ $client_id" -done < <(echo "$CLIENTS" | jq -c '.[]') - -if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID1 Keycloak" >&2; exit 1 -fi -echo "Creating keycloak-client-secrets-mosipid1 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid1 \ - "${SECRET_ARGS[@]}" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid1 created" - -echo "eSignet MOSIPID1 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh index e79d80caf..8be5e8239 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh @@ -1,5 +1,5 @@ #!/bin/bash -# Post-install hook for esignet-keycloak-init (eSignet 1.7.1 standalone) +# Post-install hook for esignet-keycloak-init (eSignet 2.0.0 (Go) standalone) # The chart runs in keycloak ns and creates keycloak-host CM and # keycloak-client-secrets secret there. This hook fans those resources out to # all esignet-mock namespaces so every esignet-mock instance can reference them without @@ -10,13 +10,13 @@ KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" # All esignet-mock namespaces that need keycloak resources -ESIGNET_NAMESPACES=(esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird) +ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid esignet-sunbird) echo "================================================" -echo "eSignet 1.7.1 - Keycloak Init Post-install" +echo "eSignet 2.0.0 (Go) - Keycloak Init Post-install" echo "================================================" -echo "Sharing keycloak resources from $KEYCLOAK_NS to all esignet-go-mock namespaces" +echo "Sharing keycloak resources from $KEYCLOAK_NS to all esignet-mock namespaces" for NS_TARGET in "${ESIGNET_NAMESPACES[@]}"; do if ! kubectl get namespace "$NS_TARGET" &>/dev/null; then echo "Namespace $NS_TARGET does not exist, skipping" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index eec0071d5..72f6052ba 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -14,7 +14,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" POSTGRES_NS="postgres" REDIS_NS="redis" KEYCLOAK_NS="keycloak" @@ -41,7 +41,7 @@ $COPY_UTIL configmap postgres-config "$POSTGRES_NS" "$ESIGNET_NS" # Override postgres-config with 2.0.0-specific DB values (isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_go","database-username":"esignetuser_go"}}' + -p '{"data":{"database-name":"mosip_esignet","database-username":"esignetuser"}}' echo "Copying redis-config configmap from $REDIS_NS" $COPY_UTIL configmap redis-config "$REDIS_NS" "$ESIGNET_NS" @@ -65,8 +65,8 @@ $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" # external-dsf.yaml esignet-keycloak-init release), but that hook's namespace loop only # covers the original esignet-standalone namespaces. Copy them directly here so the # 2.0.0 namespace is self-sufficient without touching the shared hook. This runs for -# every instance that delegates to this script (esignet-go-mock plus the -# mosipid1/mosipid2/sunbird wrappers), matching the original profile's fan-out to all +# every instance that delegates to this script (esignet-mock plus the +# mosipid/sunbird wrappers), matching the original profile's fan-out to all # four namespaces. echo "Copying keycloak-host configmap from $KEYCLOAK_NS" $COPY_UTIL configmap keycloak-host "$KEYCLOAK_NS" "$ESIGNET_NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh index 20c40638d..a25dd63d6 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh @@ -3,13 +3,13 @@ # eSignet 1.7.1 - eSignet Sunbird Service Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-sunbird, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-go-sunbird secret +# postgres + redis config/secrets), then creates esignet-captcha-sunbird secret # in the captcha namespace from workflow env vars, copies it to esignet-sunbird, # and patches the captcha deployment with the Sunbird secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" CAPTCHA_SITE_KEY="${ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY must be set}" @@ -22,18 +22,18 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go-sunbird.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-sunbird.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go-sunbird.${domain_name}" \ + --from-literal=mosip-signup-host="signup-sunbird.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - # Override postgres-config with Sunbird-specific DB values kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_go_sunbird","database-username":"esignetuser_go_sunbird"}}' + -p '{"data":{"database-name":"mosip_esignet_sunbird","database-username":"esignetuser_sunbird"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then @@ -42,23 +42,36 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-go-sunbird secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-sunbird \ +echo "Creating esignet-captcha-sunbird secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-sunbird \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-go-sunbird secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-go-sunbird "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-sunbird secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-sunbird "$CAPTCHA_NS" "$ESIGNET_NS" echo "Patching captcha deployment with ESIGNETSUNBIRD secret key" +# Remove the old pre-rename env var name if still present, so it doesn't linger +# pointing at a secret that no longer exists (esignet-captcha-go-sunbird was renamed +# to esignet-captcha-sunbird). +OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD" | cut -d: -f1 || echo "") +if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" +fi + ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-sunbird", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-sunbird", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD already exists." fi echo "eSignet Sunbird pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh index 14e0b8eb9..ea238f1b5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KAFKA_URL="${KAFKA_URL:-kafka-0.kafka-headless.kafka.svc.cluster.local:9092,kafka-1.kafka-headless.kafka.svc.cluster.local:9092,kafka-2.kafka-headless.kafka.svc.cluster.local:9092}" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh index b4f4546ab..9d1ae319a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh @@ -15,7 +15,7 @@ # ============================================================================= set -euo pipefail -KERNEL_NS="kernel-go" +KERNEL_NS="kernel" API_HOST="${MOSIP_API_HOST:-}" API_INTERNAL_HOST="${MOSIP_API_INTERNAL_HOST:-}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh index 6e4fbedf1..9192e2bdc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh @@ -13,7 +13,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KEYCLOAK_NS="keycloak" CHART_VERSION="${KEYCLOAK_INIT_VERSION:-12.0.2}" INSTALLATION_DOMAIN="${INSTALLATION_DOMAIN:-sandbox.xyz.net}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh index 8f006956d..be79632da 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh @@ -7,11 +7,11 @@ # before postgres-init-mock-identity helm chart runs DB initialization. # # Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet-go-mock) +# ESIGNET_NS - eSignet namespace (default: esignet-mock) # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh index 4d51968bf..9455bbdec 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -5,19 +5,19 @@ # Prepares esignet namespace for mock identity system deployment: # - Copies softhsm-mock-identity-system secret from softhsm ns # - Creates mockid-postgres-config with mock identity DB values -# - Verifies softhsm-mock-identity-system-go-share ConfigMap is present +# - Verifies softhsm-mock-identity-system-share ConfigMap is present # # Environment Variables: -# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem_go) -# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser_go) +# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem) +# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser) # MOCKID_DB_PORT - Postgres port (default: 5432) # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" -SOFTHSM_NS="softhsm-go" -MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem_go}" -MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser_go}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +SOFTHSM_NS="softhsm" +MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem}" +MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser}" MOCKID_DB_PORT="${MOCKID_DB_PORT:-5432}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" @@ -29,8 +29,8 @@ kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply # Copy softhsm-mock-identity-system secret to esignet ns # The chart references it directly via secretKeyRef — pod and secret must be in same namespace -$COPY_UTIL secret softhsm-mock-identity-system-go "$SOFTHSM_NS" "$ESIGNET_NS" -echo "softhsm-mock-identity-system-go secret copied to $ESIGNET_NS." +$COPY_UTIL secret softhsm-mock-identity-system "$SOFTHSM_NS" "$ESIGNET_NS" +echo "softhsm-mock-identity-system secret copied to $ESIGNET_NS." # Read internal host from postgres-config (already present from esignet-preinstall.sh) DB_HOST=$(kubectl -n "$ESIGNET_NS" get configmap postgres-config \ @@ -50,11 +50,11 @@ kubectl -n "$ESIGNET_NS" create configmap mockid-postgres-config \ echo "mockid-postgres-config created/updated in $ESIGNET_NS (host=$DB_HOST db=$MOCKID_DB_NAME user=$MOCKID_DB_USER)." # Verify SoftHSM mock identity configmap exists in esignet namespace -if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-go-share &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-share &>/dev/null; then echo "SoftHSM mock identity system configmap found." else - echo "ERROR: softhsm-mock-identity-system-go-share configmap not found in $ESIGNET_NS namespace." - echo "Deploy softhsm-mock-identity-system-go before running mock identity system install." + echo "ERROR: softhsm-mock-identity-system-share configmap not found in $ESIGNET_NS namespace." + echo "Deploy softhsm-mock-identity-system before running mock identity system install." exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh similarity index 68% rename from Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh index 78db8d94c..f86affce4 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh @@ -1,10 +1,10 @@ #!/bin/bash # ============================================================================= -# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh deleted file mode 100755 index e6e8f3496..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID2 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service -# preinstall (creates private key secrets in the target namespace). -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh index f2736d682..aa3a24fb6 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" CLIENT_KEY_TMPFILE="" JWE_KEY_TMPFILE="" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh index 74bc76ee2..077947de5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh @@ -6,5 +6,5 @@ # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh similarity index 57% rename from Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh index eccf10272..7e960eba9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh @@ -1,24 +1,24 @@ #!/bin/bash # ============================================================================= -# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID Pre-install # ============================================================================= -# Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid1 namespace before UI deployment. +# Ensures esignet-mosipid namespace exists and verifies mock-relying-party-service +# is available in the esignet-mosipid namespace before UI deployment. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-go-mosipid1" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service &>/dev/null; then echo "Mock relying party service found in $ESIGNET_NS." else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." fi -echo "Mock relying party UI MOSIPID1 pre-install completed." +echo "Mock relying party UI MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh deleted file mode 100755 index 3c65bbbcc..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install -# ============================================================================= -# Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid2 namespace before UI deployment. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-go-mosipid2" - -echo "================================================" -echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install" -echo "================================================" - -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then - echo "Mock relying party service found in $ESIGNET_NS." -else - echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." -fi - -echo "Mock relying party UI MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh index 220b444ae..aeb2c84a9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh @@ -11,10 +11,10 @@ echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install" echo "================================================" # Ensure esignet namespace exists -kubectl create namespace esignet-go-mock --dry-run=client -o yaml | kubectl apply -f - +kubectl create namespace esignet-mock --dry-run=client -o yaml | kubectl apply -f - # Verify mock relying party service is available -if kubectl -n esignet-go-mock get svc mock-relying-party-service-go &>/dev/null; then +if kubectl -n esignet-mock get svc mock-relying-party-service &>/dev/null; then echo "Mock relying party service found." else echo "WARNING: Mock relying party service not found. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh index 9d37c849f..d98a62acc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh @@ -7,7 +7,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-go-sunbird" +ESIGNET_NS="esignet-sunbird" echo "================================================" echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install" @@ -15,7 +15,7 @@ echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service &>/dev/null; then echo "Mock relying party service found in $ESIGNET_NS." else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh index 5bf32602a..a42a62267 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh @@ -7,15 +7,15 @@ # ============================================================================= set -euo pipefail -KERNEL_NS="kernel-go" +KERNEL_NS="kernel" echo "================================================" echo "eSignet Standalone 2.0.0 - Notifier Post-install" echo "================================================" # Source: deploy/kernel/install.sh - kubectl set env deployment/notifier -echo "Setting SMS number length env vars on notifier-go deployment" -kubectl -n "$KERNEL_NS" set env deployment/notifier-go \ +echo "Setting SMS number length env vars on notifier deployment" +kubectl -n "$KERNEL_NS" set env deployment/notifier \ MOSIP_KERNEL_SMS_NUMBER_MIN_LENGTH=7 \ MOSIP_KERNEL_SMS_NUMBER_MAX_LENGTH=10 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh index 9ccb94471..fca557915 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID2 Pre-install +# eSignet 1.7.1 - OIDC UI MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base oidc-ui preinstall. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh deleted file mode 100755 index 57aa055fa..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet Standalone 2.0.0 - OIDC UI MOSIPID1 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid1" -exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh index 3edf203d4..d25717fb5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - OIDC UI Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh index 9ab201731..b7e0826cf 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh similarity index 61% rename from Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh index 6ac2fe3fc..ecea9f0b0 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh @@ -1,45 +1,45 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID2 Pre-install +# eSignet 1.7.1 - PMS Partner MOSIPID Pre-install # ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid2 namespace. +# Creates the Istio Gateway for pms-partner in esignet-mosipid namespace. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-go-mosipid2" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID2 Pre-install" +echo "eSignet 1.7.1 - PMS Partner MOSIPID Pre-install" echo "================================================" kubectl apply -f - </dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n captcha captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO", "valueFrom": {"secretKeyRef": {"name": "signup-captcha-go", "key": "signup-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP", "valueFrom": {"secretKeyRef": {"name": "signup-captcha", "key": "signup-captcha-secret-key"}}}}]' else - echo "Restarting captcha to load the updated signup-go secret." + echo "Restarting captcha to load the updated signup secret." kubectl -n captcha rollout restart deployment/captcha kubectl -n captcha rollout status deployment/captcha --timeout=480s fi @@ -81,8 +81,8 @@ kubectl -n "$SIGNUP_NS" create secret generic signup-keystore \ # --- Step 6: Create msg-gateway configmap and secret (pointing to mock-smtp) --- echo "Creating msg-gateway configmap and secret in $SIGNUP_NS" kubectl -n "$SIGNUP_NS" create configmap msg-gateway \ - --from-literal=smtp-host="mock-smtp-go.mock-smtp-go" \ - --from-literal=sms-host="mock-smtp-go.mock-smtp-go" \ + --from-literal=smtp-host="mock-smtp.mock-smtp" \ + --from-literal=sms-host="mock-smtp.mock-smtp" \ --from-literal=smtp-port="8025" \ --from-literal=sms-port="8080" \ --from-literal=smtp-username="" \ diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh similarity index 65% rename from Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh index c9d0ccc04..120c2b1e0 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - SoftHSM eSignet MOSIPID1 Pre-install Setup +# eSignet 1.7.1 - SoftHSM eSignet MOSIPID Pre-install Setup # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base softhsm setup. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base softhsm setup. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh deleted file mode 100755 index 9d16c2ec8..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - SoftHSM eSignet MOSIPID2 Pre-install Setup -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base softhsm setup. -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh index 2818214bc..4b990127c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh @@ -12,8 +12,8 @@ # ============================================================================= set -euo pipefail -SOFTHSM_NS="${SOFTHSM_NS:-softhsm-go}" -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +SOFTHSM_NS="${SOFTHSM_NS:-softhsm}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" @@ -22,15 +22,15 @@ echo "================================================" # --- Step 1: Wait for SoftHSM pod to be ready --- echo "Waiting for SoftHSM pod to be ready..." -kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm-go --timeout=480s || \ +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm --timeout=480s || \ { echo "ERROR: SoftHSM pod not ready after timeout" >&2; exit 1; } -# --- Step 2: Copy esignet-softhsm-go-share configmap to esignet namespace --- -echo "Copying esignet-softhsm-go-share configmap to $ESIGNET_NS namespace" -$COPY_UTIL configmap esignet-softhsm-go-share "$SOFTHSM_NS" "$ESIGNET_NS" +# --- Step 2: Copy esignet-softhsm-share configmap to esignet namespace --- +echo "Copying esignet-softhsm-share configmap to $ESIGNET_NS namespace" +$COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" # --- Step 3: Copy esignet-softhsm secret to esignet namespace --- -echo "Copying esignet-softhsm-go secret to $ESIGNET_NS namespace" -$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" +echo "Copying esignet-softhsm secret to $ESIGNET_NS namespace" +$COPY_UTIL secret esignet-softhsm "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM eSignet post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh index 84f6961e0..54fa57156 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - SoftHSM eSignet Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh index 1e9584f8a..5007357b3 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base softhsm setup. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh index f8a711787..5349e447c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh @@ -2,14 +2,14 @@ # ============================================================================= # eSignet 1.7.1 - SoftHSM Mock Identity System Post-install # ============================================================================= -# Copies chart-generated softhsm-mock-identity-system-go-share configmap +# Copies chart-generated softhsm-mock-identity-system-share configmap # (PKCS11 slot/token config) from softhsm namespace to esignet-mock namespace. # The security PIN is handled separately via secret copy in preinstall. # ============================================================================= set -euo pipefail -SOFTHSM_NS="${SOFTHSM_NS:-softhsm-go}" -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +SOFTHSM_NS="${SOFTHSM_NS:-softhsm}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" @@ -17,11 +17,11 @@ echo "eSignet 1.7.1 - SoftHSM Mock Identity System Post-install" echo "================================================" # Wait for SoftHSM mock identity pod to be ready -kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=softhsm-mock-identity-system-go --timeout=480s || \ +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=softhsm-mock-identity-system --timeout=480s || \ { echo "ERROR: SoftHSM mock identity system pod not ready after timeout" >&2; exit 1; } # Copy chart-generated PKCS11 configmap to esignet-mock namespace -echo "Copying softhsm-mock-identity-system-go-share configmap to $ESIGNET_NS" -$COPY_UTIL configmap softhsm-mock-identity-system-go-share "$SOFTHSM_NS" "$ESIGNET_NS" +echo "Copying softhsm-mock-identity-system-share configmap to $ESIGNET_NS" +$COPY_UTIL configmap softhsm-mock-identity-system-share "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM mock identity system post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh index d27bd7d54..99a1ea0dc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh @@ -11,7 +11,7 @@ echo "eSignet 1.7.1 - SoftHSM Mock Identity System Pre-install" echo "================================================" # Ensure softhsm namespace exists -kubectl create namespace softhsm-go --dry-run=client -o yaml | kubectl apply -f - -kubectl label namespace softhsm-go istio-injection=enabled --overwrite +kubectl create namespace softhsm --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace softhsm istio-injection=enabled --overwrite echo "SoftHSM mock identity system pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh index 99884df6b..1b31cbfee 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh @@ -3,9 +3,9 @@ # eSignet Standalone 2.0.0 - Trigger Testrig CronJobs # ============================================================================= # Immediately triggers testrig CronJobs after deployment: -# apitestrig → esignet-go-mock ns -# signup-apitestrig → signup-go ns (if deployed) -# signup-uitestrig → signup-uitestrig-go ns (if deployed) +# apitestrig → esignet-mock ns +# signup-apitestrig → signup ns (if deployed) +# signup-uitestrig → signup-uitestrig ns (if deployed) # ============================================================================= set -euo pipefail @@ -111,23 +111,20 @@ echo "================================================" echo "eSignet Standalone 2.0.0 - Trigger Testrig CronJobs" echo "================================================" -echo "=== eSignet API Testrig (esignet-go-mock ns) ===" -trigger_all_in_ns esignet-go-mock || OVERALL_SUCCESS=false +echo "=== eSignet API Testrig (esignet-mock ns) ===" +trigger_all_in_ns esignet-mock || OVERALL_SUCCESS=false -echo "=== eSignet-MOSIPID1 API Testrig (esignet-go-mosipid1 ns) ===" -trigger_all_in_ns esignet-go-mosipid1 || OVERALL_SUCCESS=false +echo "=== eSignet-MOSIPID API Testrig (esignet-mosipid ns) ===" +trigger_all_in_ns esignet-mosipid || OVERALL_SUCCESS=false -echo "=== eSignet-MOSIPID2 API Testrig (esignet-go-mosipid2 ns) ===" -trigger_all_in_ns esignet-go-mosipid2 || OVERALL_SUCCESS=false +echo "=== eSignet-Sunbird API Testrig (esignet-sunbird ns) ===" +trigger_all_in_ns esignet-sunbird || OVERALL_SUCCESS=false -echo "=== eSignet-Sunbird API Testrig (esignet-go-sunbird ns) ===" -trigger_all_in_ns esignet-go-sunbird || OVERALL_SUCCESS=false +echo "=== Signup API Testrig (signup ns, if deployed) ===" +trigger_all_in_ns signup || OVERALL_SUCCESS=false -echo "=== Signup API Testrig (signup-go ns, if deployed) ===" -trigger_all_in_ns signup-go || OVERALL_SUCCESS=false - -echo "=== Signup UI Testrig (signup-uitestrig-go ns, if deployed) ===" -trigger_all_in_ns signup-uitestrig-go || OVERALL_SUCCESS=false +echo "=== Signup UI Testrig (signup-uitestrig ns, if deployed) ===" +trigger_all_in_ns signup-uitestrig || OVERALL_SUCCESS=false echo "" echo "=== Testrig Execution Summary ===" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh index 102ff6a9c..8564065a5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh @@ -2,14 +2,14 @@ # ============================================================================= # eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install Setup # ============================================================================= -# Prepares the signup-uitestrig-go namespace. +# Prepares the signup-uitestrig namespace. # Copies keycloak resources from keycloak ns, MinIO s3 secret from minio ns, # and postgres-postgresql from postgres ns. # Stale uitestrig CMs are deleted so the chart recreates them from set: values. # ============================================================================= set -euo pipefail -NS=signup-uitestrig-go +NS=signup-uitestrig COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" From d140705ea3e5897927cfc0bf574a66df79495539 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 15:23:22 +0530 Subject: [PATCH 050/127] Update esignet-standalone-2.0.0 database entries in shared external-dsf.yaml Consolidates mosip_esignet_go_mosipid1/mosipid2 into a single mosip_esignet_go_mosipid entry, matching the DSF's mosipid consolidation. Also fixes a naming collision the plain "-go" removal would have caused: this file packs both the v1.7.1 and Go profiles' database definitions into the same flat set: maps (postgres-init-esignet, postgres-init-signup), distinguished only by the _go suffix. Dropping _go from mosip_esignet_go/_sunbird, mosip_mockidentitysystem_go, mosip_audit_go, mosip_kernel_go, and mosip_otp_go would produce duplicate keys colliding with the still-present (retired) v1.7.1 entries. Instead these 6 entries are disabled and the Go profile's hooks now point at the same physical databases the v1.7.1 profile already defines, avoiding both the collision and redundant isolated databases. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../dsf/esignet-standalone/external-dsf.yaml | 65 +++++++++---------- 1 file changed, 31 insertions(+), 34 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index f44e721d9..a956215a7 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -184,9 +184,15 @@ apps: databases.mosip_mockidentitysystem.su.secret.name: "postgres-postgresql" databases.mosip_mockidentitysystem.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- - # esignet-standalone-2.0.0 profile — isolated databases (own data, shared postgres) + # esignet-standalone-2.0.0 profile databases # --------------------------------------------------------------------------- - databases.mosip_esignet_go.enabled: "true" + # mosip_esignet_go / mosip_esignet_go_sunbird / mosip_mockidentitysystem_go + # are disabled — the Go profile shares the same physical databases as the + # (retired) v1.7.1 profile above (mosip_esignet / mosip_esignet_sunbird / + # mosip_mockidentitysystem) instead of maintaining isolated duplicates. Kept + # with the _go suffix (rather than deleted) so the key stays distinct from + # the v1.7.1 entries above in this flat set: map. + databases.mosip_esignet_go.enabled: "false" databases.mosip_esignet_go.scriptsDir: "mosip_esignet" databases.mosip_esignet_go.dbName: "mosip_esignet_go" databases.mosip_esignet_go.dbUser: "esignetuser_go" @@ -199,33 +205,20 @@ apps: databases.mosip_esignet_go.su.user: "postgres" databases.mosip_esignet_go.su.secret.name: "postgres-postgresql" databases.mosip_esignet_go.su.secret.key: "postgres-password" - databases.mosip_esignet_go_mosipid1.enabled: "true" - databases.mosip_esignet_go_mosipid1.scriptsDir: "mosip_esignet" - databases.mosip_esignet_go_mosipid1.dbName: "mosip_esignet_go_mosipid1" - databases.mosip_esignet_go_mosipid1.dbUser: "esignetuser_go_mosipid1" - databases.mosip_esignet_go_mosipid1.branch: "develop" - databases.mosip_esignet_go_mosipid1.host: "postgres.${domain_name}" - databases.mosip_esignet_go_mosipid1.port: ${esignet_db_port} - databases.mosip_esignet_go_mosipid1.dml: 1 - databases.mosip_esignet_go_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_go_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_go_mosipid1.su.user: "postgres" - databases.mosip_esignet_go_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_go_mosipid1.su.secret.key: "postgres-password" - databases.mosip_esignet_go_mosipid2.enabled: "true" - databases.mosip_esignet_go_mosipid2.scriptsDir: "mosip_esignet" - databases.mosip_esignet_go_mosipid2.dbName: "mosip_esignet_go_mosipid2" - databases.mosip_esignet_go_mosipid2.dbUser: "esignetuser_go_mosipid2" - databases.mosip_esignet_go_mosipid2.branch: "develop" - databases.mosip_esignet_go_mosipid2.host: "postgres.${domain_name}" - databases.mosip_esignet_go_mosipid2.port: ${esignet_db_port} - databases.mosip_esignet_go_mosipid2.dml: 1 - databases.mosip_esignet_go_mosipid2.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_go_mosipid2.defaultDb: "postgres" - databases.mosip_esignet_go_mosipid2.su.user: "postgres" - databases.mosip_esignet_go_mosipid2.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_go_mosipid2.su.secret.key: "postgres-password" - databases.mosip_esignet_go_sunbird.enabled: "true" + databases.mosip_esignet_go_mosipid.enabled: "true" + databases.mosip_esignet_go_mosipid.scriptsDir: "mosip_esignet" + databases.mosip_esignet_go_mosipid.dbName: "mosip_esignet_go_mosipid" + databases.mosip_esignet_go_mosipid.dbUser: "esignetuser_go_mosipid" + databases.mosip_esignet_go_mosipid.branch: "develop" + databases.mosip_esignet_go_mosipid.host: "postgres.${domain_name}" + databases.mosip_esignet_go_mosipid.port: ${esignet_db_port} + databases.mosip_esignet_go_mosipid.dml: 1 + databases.mosip_esignet_go_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_go_mosipid.defaultDb: "postgres" + databases.mosip_esignet_go_mosipid.su.user: "postgres" + databases.mosip_esignet_go_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_go_mosipid.su.secret.key: "postgres-password" + databases.mosip_esignet_go_sunbird.enabled: "false" databases.mosip_esignet_go_sunbird.scriptsDir: "mosip_esignet" databases.mosip_esignet_go_sunbird.dbName: "mosip_esignet_go_sunbird" databases.mosip_esignet_go_sunbird.dbUser: "esignetuser_go_sunbird" @@ -238,7 +231,7 @@ apps: databases.mosip_esignet_go_sunbird.su.user: "postgres" databases.mosip_esignet_go_sunbird.su.secret.name: "postgres-postgresql" databases.mosip_esignet_go_sunbird.su.secret.key: "postgres-password" - databases.mosip_mockidentitysystem_go.enabled: "true" + databases.mosip_mockidentitysystem_go.enabled: "false" databases.mosip_mockidentitysystem_go.scriptsDir: "mosip_mockidentitysystem" databases.mosip_mockidentitysystem_go.dbName: "mosip_mockidentitysystem_go" databases.mosip_mockidentitysystem_go.dbUser: "mockidentityuser_go" @@ -308,21 +301,25 @@ apps: databases.mosip_otp.port: ${esignet_db_port} databases.mosip_otp.dml: 0 # --------------------------------------------------------------------------- - # esignet-standalone-2.0.0 profile — isolated signup/kernel databases + # esignet-standalone-2.0.0 profile — signup/kernel databases # --------------------------------------------------------------------------- - databases.mosip_audit_go.enabled: "true" + # Disabled — the Go profile shares the same physical mosip_audit/mosip_kernel/ + # mosip_otp databases as above instead of maintaining isolated duplicates. Kept + # with the _go suffix (rather than deleted) so the key stays distinct from the + # entries above in this flat set: map. + databases.mosip_audit_go.enabled: "false" databases.mosip_audit_go.branch: "v1.2.0.1" databases.mosip_audit_go.repoUrl: "https://github.com/mosip/audit-manager.git" databases.mosip_audit_go.host: "postgres.${domain_name}" databases.mosip_audit_go.port: ${esignet_db_port} databases.mosip_audit_go.dml: 0 - databases.mosip_kernel_go.enabled: "true" + databases.mosip_kernel_go.enabled: "false" databases.mosip_kernel_go.branch: "v1.2.0.1" databases.mosip_kernel_go.repoUrl: "https://github.com/mosip/commons.git" databases.mosip_kernel_go.host: "postgres.${domain_name}" databases.mosip_kernel_go.port: ${esignet_db_port} databases.mosip_kernel_go.dml: 0 - databases.mosip_otp_go.enabled: "true" + databases.mosip_otp_go.enabled: "false" databases.mosip_otp_go.branch: "v1.2.0.1" databases.mosip_otp_go.repoUrl: "https://github.com/mosip/otp-manager.git" databases.mosip_otp_go.host: "postgres.${domain_name}" From fd5fd1b268280bc0d44100e13c09ed9ff785ee29 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 15:23:34 +0530 Subject: [PATCH 051/127] Add mosipid_domain_name and Go-profile secrets to eSignet/testrig workflows The esignet-standalone-2.0.0 DSFs now use a single \${mosipid_domain_name} variable instead of mosipid1/mosipid2. The v1.7.1 esignet-standalone profile still runs two separate mosipid1/mosipid2 instances, so its existing inputs, secrets, and MOSIPID2_ENABLED toggle are left as-is; mosipid_domain_name and the new ESIGNET_MOSIPID_CAPTCHA_*, MOSIPID_POSTGRES_PASSWORD, MOSIPID_KEYCLOAK_ADMIN_PASSWORD, and ESIGNET_MOSIPID_SPRING_CONFIG_LABEL secrets/vars are added alongside them, with validation now branching by exact profile name. Also updates the SOFTHSM_PAIRS release/namespace list for esignet-standalone-2.0.0 to match the renamed releases. Note: the new MOSIPID_* secrets/vars need to be configured in the GitHub environment before a real esignet-standalone-2.0.0 deployment run. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 81 +++++++++++++++++++++---- .github/workflows/helmsman_testrigs.yml | 33 ++++++++-- 2 files changed, 96 insertions(+), 18 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index f2753edf1..77f56a242 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -52,6 +52,10 @@ on: description: "MOSIP-ID2 domain name for this environment (e.g. qabase.xyz.net)" required: false type: string + mosipid_domain_name: + description: "MOSIP-ID domain name for esignet-standalone-2.0.0 (Go) profile only (e.g. qabase.xyz.net)" + required: false + type: string env_name: description: "Environment name (e.g. sandbox, dev, staging)" required: false @@ -91,13 +95,16 @@ jobs: echo "✓ domain_name = $DOMAIN" echo "✓ env_name = $ENV" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. + # mosipid1/mosipid2_domain_name are esignet-standalone (v1.7.1) only — that + # profile still runs two separate mosipid1/mosipid2 instances. + # mosipid_domain_name is esignet-standalone-2.0.0 (Go) only — that profile + # consolidates mosipid1+mosipid2 into a single mosipid instance. # Push events always target esignet (path filter); dispatch uses explicit profile input. - if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then + if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" if [ -z "$MOSIPID1_DOMAIN" ]; then - echo "❌ mosipid1_domain_name is required for standalone profiles" + echo "❌ mosipid1_domain_name is required for esignet-standalone" exit 1 fi if [ "$IN_ENABLE_MOSIPID2" = "true" ] && @@ -111,11 +118,23 @@ jobs: MOSIPID2_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }}" echo "✓ mosipid1_spring_config_label = ${MOSIPID1_SPRING_LABEL:-develop} (esignet standalone, default: develop)" echo "✓ mosipid2_spring_config_label = ${MOSIPID2_SPRING_LABEL:-develop} (esignet standalone, default: develop)" - else + fi + if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + MOSIPID_DOMAIN="${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }}" + if [ -z "$MOSIPID_DOMAIN" ]; then + echo "❌ mosipid_domain_name is required for esignet-standalone-2.0.0" + exit 1 + fi + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone 2.0.0 / Go)" + MOSIPID_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }}" + echo "✓ mosipid_spring_config_label = ${MOSIPID_SPRING_LABEL:-develop} (esignet standalone 2.0.0, default: develop)" + fi + if [ -n "$PROFILE" ] && [ "$PROFILE" != "esignet-standalone" ] && [ "$PROFILE" != "esignet-standalone-2.0.0" ]; then MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" + MOSIPID_PROVIDED="${{ github.event.inputs.mosipid_domain_name }}" + if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ] || [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid1_domain_name / mosipid2_domain_name / mosipid_domain_name are only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -132,6 +151,7 @@ jobs: esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} + mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} # All secrets below are ENVIRONMENT secrets (not repository secrets) @@ -147,11 +167,17 @@ jobs: ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }} ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }} ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }} - # MOSIPID1 / MOSIPID2 remote Keycloak admin + Postgres passwords + # mosipid captcha secret — required for esignet-standalone-2.0.0 (Go) profile only + ESIGNET_MOSIPID_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }} + ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }} + # MOSIPID1 / MOSIPID2 remote Keycloak admin + Postgres passwords (esignet-standalone) MOSIPID1_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID1_KEYCLOAK_ADMIN_PASSWORD }} MOSIPID2_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID2_KEYCLOAK_ADMIN_PASSWORD }} MOSIPID1_POSTGRES_PASSWORD: ${{ secrets.MOSIPID1_POSTGRES_PASSWORD }} MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} + # MOSIPID remote Keycloak admin + Postgres password (esignet-standalone-2.0.0 / Go) + MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD }} + MOSIPID_POSTGRES_PASSWORD: ${{ secrets.MOSIPID_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }} # Spring config label per namespace — controls which Git branch/tag the config-server uses @@ -159,6 +185,7 @@ jobs: # If unset, hooks default to 'develop' ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }} ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }} + ESIGNET_MOSIPID_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }} # Cluster access secrets KUBECONFIG_SECRET: ${{ secrets.KUBECONFIG }} CLUSTER_WIREGUARD_WG0: ${{ secrets.CLUSTER_WIREGUARD_WG0 }} @@ -203,6 +230,7 @@ jobs: save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" + save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "ENV_NAME" "${{ github.event.inputs.env_name }}" - name: Mask sensitive data @@ -218,6 +246,8 @@ jobs: echo "::add-mask::${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }}" @@ -391,8 +421,8 @@ jobs: echo "✅ ESIGNET_CAPTCHA_SECRET_KEY is configured" fi - # Per-namespace captcha secrets — only required for esignet standalone profile - if [[ "$PROFILE" == esignet-standalone* ]]; then + # Per-namespace captcha secrets — only required for esignet standalone profiles + if [ "$PROFILE" = "esignet-standalone" ]; then echo "--- Validating esignet standalone mosipid1 captcha secrets ---" for var in ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY \ ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do @@ -429,6 +459,28 @@ jobs: else echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" fi + elif [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + echo "--- Validating esignet standalone 2.0.0 (Go) mosipid captcha secrets ---" + for var in ESIGNET_MOSIPID_CAPTCHA_SITE_KEY ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY \ + ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do + val="${!var:-}" + if [ -z "$val" ]; then + echo "❌ $var secret is not configured (required for esignet standalone 2.0.0)" + MISSING_SECRETS=1 + else + echo "✅ $var is configured" + fi + done + echo "--- Validating esignet standalone 2.0.0 (Go) mosipid postgres + keycloak secrets ---" + for var in MOSIPID_POSTGRES_PASSWORD MOSIPID_KEYCLOAK_ADMIN_PASSWORD; do + val="${!var:-}" + if [ -z "$val" ]; then + echo "❌ $var secret is not configured (required for esignet standalone 2.0.0)" + MISSING_SECRETS=1 + else + echo "✅ $var is configured" + fi + done fi if [ "$MISSING_SECRETS" -eq 1 ]; then @@ -443,7 +495,7 @@ jobs: echo " - MOCK_RELYING_PARTY_JWE_PRIVATE_KEY (base64 encoded PEM)" echo " - ESIGNET_CAPTCHA_SITE_KEY (reCAPTCHA site key - plain text)" echo " - ESIGNET_CAPTCHA_SECRET_KEY (reCAPTCHA secret key - plain text)" - if [[ "$PROFILE" == esignet-standalone* ]]; then + if [ "$PROFILE" = "esignet-standalone" ]; then echo " - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY" echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" echo " - MOSIPID1_POSTGRES_PASSWORD / MOSIPID1_KEYCLOAK_ADMIN_PASSWORD" @@ -451,6 +503,10 @@ jobs: echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" fi + elif [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + echo " - ESIGNET_MOSIPID_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY" + echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" + echo " - MOSIPID_POSTGRES_PASSWORD / MOSIPID_KEYCLOAK_ADMIN_PASSWORD" fi exit 1 fi @@ -554,6 +610,7 @@ jobs: echo "domain_name = $domain_name" echo "mosipid1_domain_name = $mosipid1_domain_name" echo "mosipid2_domain_name = $mosipid2_domain_name" + echo "mosipid_domain_name = $mosipid_domain_name" echo "env_name = $env_name" - name: Initiate helmsman to apply the DSF configurations @@ -597,7 +654,7 @@ jobs: SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid1:esignet-mosipid1" "esignet-softhsm-mosipid2:esignet-mosipid2" "esignet-softhsm-sunbird:esignet-sunbird") ;; esignet-standalone-2.0.0) - SOFTHSM_PAIRS=("esignet-softhsm-go:esignet-go-mock" "esignet-softhsm-go-mosipid1:esignet-go-mosipid1" "esignet-softhsm-go-mosipid2:esignet-go-mosipid2" "esignet-softhsm-go-sunbird:esignet-go-sunbird") + SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid:esignet-mosipid" "esignet-softhsm-sunbird:esignet-sunbird") ;; *) SOFTHSM_PAIRS=() @@ -643,7 +700,7 @@ jobs: echo "Commit: ${{ github.sha }}" echo "" echo "Namespaces created/updated:" - kubectl get ns esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" + kubectl get ns esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-mosipid esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" echo "" echo "eSignet pods status:" kubectl get pods -n esignet-mock 2>/dev/null || echo "esignet-mock namespace not ready" diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 1b19de8ff..93e5f52d1 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -38,6 +38,10 @@ on: description: "MOSIP-ID2 domain name (e.g. mosipenv2.xyz.net) — required only when enable_mosipid2 is set" required: false type: string + mosipid_domain_name: + description: "MOSIP-ID domain name for esignet-standalone-2.0.0 (Go) profile only (e.g. mosipenv.xyz.net)" + required: false + type: string db_port: description: "PostgreSQL port for MOSIP platform external postgres (e.g. 5433)" required: true @@ -79,6 +83,8 @@ jobs: VAR_MOSIPID1_DOMAIN: ${{ vars.MOSIPID1_DOMAIN_NAME }} VAR_MOSIPID2_DOMAIN: ${{ vars.MOSIPID2_DOMAIN_NAME }} IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} + IN_MOSIPID_DOMAIN: ${{ github.event.inputs.mosipid_domain_name }} + VAR_MOSIPID_DOMAIN: ${{ vars.MOSIPID_DOMAIN_NAME }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -103,13 +109,16 @@ jobs: echo "✓ slack_channel_name = $SLACK_CH" echo "✓ db_port = $DB_PORT" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. + # mosipid1/mosipid2_domain_name are esignet-standalone (v1.7.1) only — that + # profile still runs two separate mosipid1/mosipid2 instances. + # mosipid_domain_name is esignet-standalone-2.0.0 (Go) only — that profile + # consolidates mosipid1+mosipid2 into a single mosipid instance. # Push events always target the esignet profile (path filter); dispatch uses explicit profile input. - if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then + if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then MOSIPID1_DOMAIN="${IN_MOSIPID1_DOMAIN:-$VAR_MOSIPID1_DOMAIN}" MOSIPID2_DOMAIN="${IN_MOSIPID2_DOMAIN:-$VAR_MOSIPID2_DOMAIN}" if [ -z "$MOSIPID1_DOMAIN" ]; then - echo "❌ mosipid1_domain_name is required for standalone profiles" + echo "❌ mosipid1_domain_name is required for esignet-standalone" exit 1 fi if [ "$IN_ENABLE_MOSIPID2" = "true" ] && @@ -119,11 +128,21 @@ jobs: fi echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" - else + fi + if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + MOSIPID_DOMAIN="${IN_MOSIPID_DOMAIN:-$VAR_MOSIPID_DOMAIN}" + if [ -z "$MOSIPID_DOMAIN" ]; then + echo "❌ mosipid_domain_name is required for esignet-standalone-2.0.0" + exit 1 + fi + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone 2.0.0 / Go)" + fi + if [ -n "$PROFILE" ] && [ "$PROFILE" != "esignet-standalone" ] && [ "$PROFILE" != "esignet-standalone-2.0.0" ]; then MOSIPID1_PROVIDED="$IN_MOSIPID1_DOMAIN" MOSIPID2_PROVIDED="$IN_MOSIPID2_DOMAIN" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" + MOSIPID_PROVIDED="$IN_MOSIPID_DOMAIN" + if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ] || [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid1_domain_name / mosipid2_domain_name / mosipid_domain_name are only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -139,6 +158,7 @@ jobs: domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} + mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} db_port: ${{ github.event.inputs.db_port || vars.DB_PORT }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} @@ -184,6 +204,7 @@ jobs: save_var "DOMAIN_NAME" "${{ github.event.inputs.domain_name }}" save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" + save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "DB_PORT" "${{ github.event.inputs.db_port }}" save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" save_var "ENV_NAME" "${{ github.event.inputs.env_name }}" From 252e0429b7debe67a81bb2997dd8ec9ea49b5760 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:13:47 +0530 Subject: [PATCH 052/127] Consolidate mosipid1/mosipid2 into a single mosipid instance for esignet-standalone Applies the same consolidation already done for the Go profile to the v1.7.1 esignet-standalone profile: mosipid1 was always-enabled with a more complete config (captcha explicitly configured) while mosipid2 was optional and off by default, so mosipid1's config becomes canonical. Deletes mosipid2's app blocks, hook scripts, and plugin-values file, and renames mosipid1's to the consolidated mosipid name throughout the DSF, testrigs DSF, and hooks. Also fixes softhsm-esignet-mosipid1/2-values.yaml references that were left dangling by the earlier Go-profile task: those files were shared with the Go profile and got renamed/deleted there without accounting for this profile's own use of them, silently breaking this profile's softhsm-mosipid app. Both profiles now correctly share the single softhsm-esignet-mosipid-values.yaml file. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../dsf/esignet-standalone/esignet-dsf.yaml | 276 ++++-------------- .../dsf/esignet-standalone/testrigs-dsf.yaml | 79 +---- ...sh => apitestrig-esignet-mosipid-setup.sh} | 12 +- .../apitestrig-esignet-mosipid2-setup.sh | 27 -- .../config-server-esignet-postinstall.sh | 20 +- .../esignet-db-postinstall.sh | 2 +- .../esignet-standalone/esignet-init-db.sh | 4 +- ...stall.sh => esignet-mosipid-preinstall.sh} | 96 +++--- .../esignet-mosipid2-preinstall.sh | 127 -------- .../esignet-postinstall-keycloak-init.sh | 2 +- ...lying-party-service-mosipid-preinstall.sh} | 6 +- ...lying-party-service-mosipid2-preinstall.sh | 10 - ...ck-relying-party-ui-mosipid-preinstall.sh} | 12 +- ...ck-relying-party-ui-mosipid2-preinstall.sh | 24 -- ...stall.sh => oidc-ui-mosipid-preinstall.sh} | 6 +- .../oidc-ui-mosipid2-preinstall.sh | 9 - ...l.sh => pms-partner-mosipid-preinstall.sh} | 20 +- .../pms-partner-mosipid2-preinstall.sh | 45 --- ...up.sh => softhsm-esignet-mosipid-setup.sh} | 6 +- .../softhsm-esignet-mosipid2-setup.sh | 9 - .../trigger-test-jobs-esignet.sh | 7 +- ...aml => esignet-mosipid-plugin-values.yaml} | 16 +- .../utils/esignet-mosipid2-plugin-values.yaml | 118 -------- 23 files changed, 178 insertions(+), 755 deletions(-) rename Helmsman/hooks/esignet-standalone/{apitestrig-esignet-mosipid1-setup.sh => apitestrig-esignet-mosipid-setup.sh} (75%) delete mode 100755 Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh rename Helmsman/hooks/esignet-standalone/{esignet-mosipid1-preinstall.sh => esignet-mosipid-preinstall.sh} (53%) delete mode 100755 Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone/{mock-relying-party-service-mosipid1-preinstall.sh => mock-relying-party-service-mosipid-preinstall.sh} (69%) delete mode 100755 Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone/{mock-relying-party-ui-mosipid1-preinstall.sh => mock-relying-party-ui-mosipid-preinstall.sh} (66%) delete mode 100755 Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone/{oidc-ui-mosipid1-preinstall.sh => oidc-ui-mosipid-preinstall.sh} (66%) delete mode 100755 Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone/{pms-partner-mosipid1-preinstall.sh => pms-partner-mosipid-preinstall.sh} (62%) delete mode 100755 Helmsman/hooks/esignet-standalone/pms-partner-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone/{softhsm-esignet-mosipid1-setup.sh => softhsm-esignet-mosipid-setup.sh} (65%) delete mode 100755 Helmsman/hooks/esignet-standalone/softhsm-esignet-mosipid2-setup.sh rename Helmsman/utils/{esignet-mosipid1-plugin-values.yaml => esignet-mosipid-plugin-values.yaml} (91%) delete mode 100644 Helmsman/utils/esignet-mosipid2-plugin-values.yaml diff --git a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml index 5db2e94be..56d5a8fd4 100644 --- a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml @@ -32,9 +32,7 @@ namespaces: protected: false softhsm: protected: false - esignet-mosipid1: - protected: false - esignet-mosipid2: + esignet-mosipid: protected: false esignet-sunbird: protected: false @@ -56,27 +54,16 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-setup.sh" - esignet-softhsm-mosipid1: - namespace: esignet-mosipid1 + esignet-softhsm-mosipid: + namespace: esignet-mosipid enabled: true version: 12.0.1 chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid1-values.yaml" - timeout: 480 - priority: -16 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid1-setup.sh" - - esignet-softhsm-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 12.0.1 - chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid2-values.yaml" + valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid-values.yaml" timeout: 480 priority: -16 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid-setup.sh" esignet-softhsm-sunbird: namespace: esignet-sunbird @@ -136,12 +123,12 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" - esignet-mosipid1: - namespace: esignet-mosipid1 + esignet-mosipid: + namespace: esignet-mosipid enabled: true version: 0.1.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-mosipid1-plugin-values.yaml" + valuesFile: "$WORKDIR/utils/esignet-mosipid-plugin-values.yaml" set: image.repository: "mosipqa/esignet-with-plugins" image.tag: "develop" @@ -150,71 +137,31 @@ apps: activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid1-share" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid1.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid1.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid1_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid1_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid1_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid1.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid1.${domain_name}" + domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid_domain_name}/mosip-certs/ida-partner.cer" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid_domain_name}/v1/authmanager/authenticate/clientidsecretkey" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid_domain_name}/v1/auditmanager/audits" + domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" timeout: 600 priority: -14 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh" - - esignet-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-mosipid2-plugin-values.yaml" - set: - image.repository: "mosipqa/esignet-with-plugins" - image.tag: "develop" - enable_insecure: "false" - springConfigNameEnv: "" - activeProfileEnv: "" - pluginNameEnv: "mosip-identity-plugin.jar" - pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid2-share" - extraEnvVarsCM[1]: "esignet-global" - metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid2.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid2.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" - domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" - domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid2_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid2_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid2_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid2.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid2.${domain_name}" - timeout: 600 - priority: -14 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid-preinstall.sh" esignet-sunbird: namespace: esignet-sunbird @@ -242,9 +189,9 @@ apps: domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" + domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" timeout: 600 priority: -14 hooks: @@ -270,39 +217,22 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" - oidc-ui-mosipid1: - namespace: esignet-mosipid1 + oidc-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.1.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop" - istio.hosts[0]: "esignet-mosipid1.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mosipid1.esignet-mosipid1" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid1.esignet-mosipid1/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid1.esignet-mosipid1" + istio.hosts[0]: "esignet-mosipid.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mosipid.esignet-mosipid" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid.esignet-mosipid" timeout: 1200 priority: -13 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh" - - oidc-ui-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/oidc-ui - set: - image.repository: "mosipqa/oidc-ui" - image.tag: "develop" - istio.hosts[0]: "esignet-mosipid2.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mosipid2.esignet-mosipid2" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid2.esignet-mosipid2/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid2.esignet-mosipid2" - timeout: 1200 - priority: -13 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh" oidc-ui-sunbird: namespace: esignet-sunbird @@ -385,35 +315,20 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" - mock-relying-party-service-mosipid1: - namespace: esignet-mosipid1 + mock-relying-party-service-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid1.esignet-mosipid1/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid1.${domain_name}/v1/esignet/oauth/v2/token" - enable_insecure: "false" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" - timeout: 480 - priority: -10 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh" - - mock-relying-party-service-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-service - set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid2.esignet-mosipid2/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid2.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 priority: -10 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh" mock-relying-party-service-sunbird: namespace: esignet-sunbird @@ -464,19 +379,19 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-preinstall.sh" - mock-relying-party-ui-mosipid1: - namespace: esignet-mosipid1 + mock-relying-party-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid1.esignet-mosipid1" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid1.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid.esignet-mosipid" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid.${domain_name}/plugins/sign-in-button-plugin.js" mock_relying_party_ui.mock_relying_party_ui_port: '5000' mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet @@ -491,46 +406,12 @@ apps: mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-mosipid1.${domain_name}" + istio.hosts[0]: "healthservices-mosipid.${domain_name}" wait: true timeout: 480 priority: -9 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh" - - mock-relying-party-ui-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-ui - set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid2.esignet-mosipid2" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid2.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" - mock_relying_party_ui.mock_relying_party_ui_port: '5000' - mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ - mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet - mock_relying_party_ui.DISPLAY: page - mock_relying_party_ui.PROMPT: consent - mock_relying_party_ui.GRANT_TYPE: authorization_code - mock_relying_party_ui.CLAIMS_LOCALES: en - mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile - mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' - mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' - mock_relying_party_ui.DEFAULT_LANG: en - mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' - mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize - mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-mosipid2.${domain_name}" - wait: true - timeout: 480 - priority: -9 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh" mock-relying-party-ui-sunbird: namespace: esignet-sunbird @@ -566,81 +447,38 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-mosipid1: - namespace: esignet-mosipid1 + pms-partner-mosipid: + namespace: esignet-mosipid enabled: false version: 12.2.3 chart: mosip/pms-partner set: # image.repository: "mosipid/partner-management-service" # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1.${domain_name}" + istio.gateways[0]: "pms-partner-mosipid-gateway" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" extraEnvVarsCM[0]: "esignet-global" extraEnvVarsCM[1]: "esignet-config-server-share" priority: -9 timeout: 1200 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh" - pms-policy-mosipid1: - namespace: esignet-mosipid1 + pms-policy-mosipid: + namespace: esignet-mosipid enabled: false version: 12.2.3 chart: mosip/pms-policy set: # image.repository: "mosipid/policy-management-service" # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1.${domain_name}" + istio.gateways[0]: "pms-partner-mosipid-gateway" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" extraEnvVarsCM[0]: "esignet-global" extraEnvVarsCM[1]: "esignet-config-server-share" priority: -9 timeout: 1200 - pms-partner-mosipid2: - namespace: esignet-mosipid2 - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid2-preinstall.sh" - - pms-policy-mosipid2: - namespace: esignet-mosipid2 - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2.${domain_name}" - priority: -9 - timeout: 1200 - - # --------------------------------------------------------------------------- - # Partner Onboarders - # --------------------------------------------------------------------------- - # Two onboarders for eSignet standalone — enable the one matching your plugin: - # esignet-mock-rp-onboarder: for mock plugin (plugin 1) and sunbird-rc (plugin 3) - # esignet-misp-onboarder: for mosip-identity-plugin (plugin 2) only - - # eSignet MISP Partner Onboarder - # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). - # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. - # After completion, restarts the esignet deployment to pick up the new MISP license key. esignet-misp-onboarder: namespace: esignet-mock enabled: false diff --git a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml index d07899ae8..2250af730 100644 --- a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml @@ -9,18 +9,15 @@ helmRepos: # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): # esignet-apitestrig → esignet ns -# esignet-mosipid1-apitestrig → esignet-mosipid1 ns -# esignet-mosipid2-apitestrig → esignet-mosipid2 ns +# esignet-mosipid-apitestrig → esignet-mosipid ns # esignet-sunbird-apitestrig → esignet-sunbird ns # esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) # signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) namespaces: - esignet-mosipid1: + esignet-mosipid: protected: false esignet-mock: protected: false - esignet-mosipid2: - protected: false esignet-sunbird: protected: false signup: @@ -75,10 +72,10 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-setup.sh" # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid1 namespace (mosip-identity-plugin) + # eSignet API Testrig — esignet-mosipid namespace (mosip-identity-plugin) # --------------------------------------------------------------------------- - esignet-mosipid1-apitestrig: - namespace: esignet-mosipid1 + esignet-mosipid-apitestrig: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -89,15 +86,15 @@ apps: extraEnvVarsCM[2]: "keycloak-host" extraEnvVarsCM[3]: "db" extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid1-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid1-apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-mosipid-apitestrig" extraEnvVarsSecret[2]: "keycloak-client-secrets" extraEnvVarsSecret[3]: "postgres-postgresql" crontime: "0 2 * * *" apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' apitestrig.configmaps.s3.s3-user-key: 'admin' apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid1_domain_name}" + apitestrig.configmaps.db.db-server: "api-internal.${mosipid_domain_name}" apitestrig.configmaps.db.db-su-user: "postgres" apitestrig.configmaps.db.db-port: "${esignet_db_port}" apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" @@ -106,70 +103,20 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid1" + apitestrig.configmaps.apitestrig.NS: "esignet-mosipid" apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid1.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid1_domain_name};idrepository=api-internal.${mosipid1_domain_name};authmanager=api-internal.${mosipid1_domain_name};resident=api-internal.${mosipid1_domain_name};partnermanager=pms-mosipid1.${mosipid1_domain_name};idauthentication=api-internal.${mosipid1_domain_name};masterdata=api-internal.${mosipid1_domain_name};idgenerator=api-internal.${mosipid1_domain_name};policymanager=pms-mosipid1.${mosipid1_domain_name};preregistration=api-internal.${mosipid1_domain_name};keymanager=api-internal.${mosipid1_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};partnermanager=pms-mosipid.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};policymanager=pms-mosipid.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -4 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh" - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid2 namespace (mosip-identity-plugin) - # --------------------------------------------------------------------------- - esignet-mosipid2-apitestrig: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/apitestrig - valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" - set: - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "s3" - extraEnvVarsCM[2]: "keycloak-host" - extraEnvVarsCM[3]: "db" - extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[2]: "keycloak-client-secrets" - extraEnvVarsSecret[3]: "postgres-postgresql" - crontime: "0 2 * * *" - apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' - apitestrig.configmaps.s3.s3-user-key: 'admin' - apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid2_domain_name}" - apitestrig.configmaps.db.db-su-user: "postgres" - apitestrig.configmaps.db.db-port: "${esignet_db_port}" - apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" - apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" - apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" - apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" - apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" - apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid2" - apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' - apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid2.${domain_name}" - apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid2_domain_name};idrepository=api-internal.${mosipid2_domain_name};authmanager=api-internal.${mosipid2_domain_name};resident=api-internal.${mosipid2_domain_name};partnermanager=pms-mosipid2.${mosipid2_domain_name};idauthentication=api-internal.${mosipid2_domain_name};masterdata=api-internal.${mosipid2_domain_name};idgenerator=api-internal.${mosipid2_domain_name};policymanager=pms-mosipid2.${mosipid2_domain_name};preregistration=api-internal.${mosipid2_domain_name};keymanager=api-internal.${mosipid2_domain_name};" - secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - apitestrig.variables.push_reports_to_s3: "yes" - priority: -3 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh" - - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-sunbird namespace (sunbird-rc-plugin) - # postInstall triggers all four testrig namespaces after last one deploys. - # --------------------------------------------------------------------------- esignet-sunbird-apitestrig: namespace: esignet-sunbird enabled: true @@ -206,7 +153,7 @@ apps: apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-sunbird.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid1_domain_name}" + apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid_domain_name}" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -2 diff --git a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh similarity index 75% rename from Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh rename to Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh index 89ef80915..a1047daa2 100755 --- a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh @@ -1,19 +1,19 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup +# eSignet 1.7.1 - eSignet-MOSIPID API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 +# Prepares the esignet-mosipid namespace for the esignet-mosipid-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid # (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql # needs to be copied; stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail -NS=esignet-mosipid1 +NS=esignet-mosipid COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install" +echo "eSignet 1.7.1 - eSignet-MOSIPID API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -24,4 +24,4 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" -echo "eSignet-MOSIPID1 API Testrig pre-install setup completed." +echo "eSignet-MOSIPID API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh deleted file mode 100755 index 9f5f75258..000000000 --- a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup -# ============================================================================= -# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. -# ============================================================================= -set -euo pipefail - -NS=esignet-mosipid2 -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install" -echo "================================================" - -echo "Deleting stale testrig configmaps in $NS" -kubectl -n "$NS" delete --ignore-not-found=true configmap s3 -kubectl -n "$NS" delete --ignore-not-found=true configmap db -kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig - -echo "Copying postgres-postgresql secret to $NS" -$COPY_UTIL secret postgres-postgresql postgres "$NS" - -echo "eSignet-MOSIPID2 API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh index 1c799425e..9309be2c1 100755 --- a/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh @@ -2,13 +2,12 @@ # ============================================================================= # eSignet 1.7.1 - Config-Server eSignet Post-install # ============================================================================= -# Copies esignet-config-server-share CM from esignet-mock ns to mosipid1/mosipid2/sunbird, +# Copies esignet-config-server-share CM from esignet-mock ns to mosipid/sunbird, # then patches active_profile_env and spring_config_label_env per namespace # so each instance points to the correct config server profile and Git label. # # Environment variables (set in GitHub Actions workflow): -# ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL - Git label for esignet-mosipid1 (default: develop) -# ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL - Git label for esignet-mosipid2 (default: develop) +# ESIGNET_MOSIPID_SPRING_CONFIG_LABEL - Git label for esignet-mosipid (default: develop) # ============================================================================= set -euo pipefail @@ -16,24 +15,19 @@ SOURCE_NS="esignet-mock" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" CM_NAME="esignet-config-server-share" -MOSIPID1_SPRING_LABEL="${ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL:-develop}" -MOSIPID2_SPRING_LABEL="${ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL:-develop}" +MOSIPID_SPRING_LABEL="${ESIGNET_MOSIPID_SPRING_CONFIG_LABEL:-develop}" echo "================================================" echo "eSignet 1.7.1 - Config-Server eSignet Post-install" echo "================================================" -for TARGET_NS in esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do +for TARGET_NS in esignet-mosipid esignet-sunbird; do echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" done -echo "Patching $CM_NAME in esignet-mosipid1 (active_profile_env=mosipid1, spring_config_label_env=$MOSIPID1_SPRING_LABEL)" -kubectl -n esignet-mosipid1 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid1\",\"spring_config_label_env\":\"$MOSIPID1_SPRING_LABEL\"}}" - -echo "Patching $CM_NAME in esignet-mosipid2 (active_profile_env=mosipid2, spring_config_label_env=$MOSIPID2_SPRING_LABEL)" -kubectl -n esignet-mosipid2 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid2\",\"spring_config_label_env\":\"$MOSIPID2_SPRING_LABEL\"}}" +echo "Patching $CM_NAME in esignet-mosipid (active_profile_env=mosipid, spring_config_label_env=$MOSIPID_SPRING_LABEL)" +kubectl -n esignet-mosipid patch configmap "$CM_NAME" --type merge \ + -p "{\"data\":{\"active_profile_env\":\"mosipid\",\"spring_config_label_env\":\"$MOSIPID_SPRING_LABEL\"}}" echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh index cf716aa72..a671a62c8 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh @@ -15,7 +15,7 @@ echo "================================================" echo "eSignet 1.7.1 - Database Init Post-install" echo "================================================" -for NS in esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do +for NS in esignet-mock esignet-mosipid esignet-sunbird; do echo "Copying db-common-secrets from $POSTGRES_NS to $NS" $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$NS" done diff --git a/Helmsman/hooks/esignet-standalone/esignet-init-db.sh b/Helmsman/hooks/esignet-standalone/esignet-init-db.sh index d382f7848..9c15c6fb5 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-init-db.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-init-db.sh @@ -7,7 +7,7 @@ # postgres-postgresql secret natively. This hook pre-creates all esignet-mock # namespaces so the postInstall hook can copy db-common-secrets into each. # Namespaces are created here at priority -16 because the namespace-specific -# preinstall hooks (esignet-mosipid1/mosipid2/sunbird) only run at priority -14. +# preinstall hooks (esignet-mosipid/sunbird) only run at priority -14. # ============================================================================= set -euo pipefail @@ -15,7 +15,7 @@ echo "================================================" echo "eSignet 1.7.1 - Database Init Pre-install" echo "================================================" -for NS in esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do +for NS in esignet-mock esignet-mosipid esignet-sunbird; do kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - kubectl label namespace "$NS" istio-injection=enabled --overwrite echo "Namespace $NS ready." diff --git a/Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh similarity index 53% rename from Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh index e768ad1d8..ef54cc13a 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh @@ -1,41 +1,41 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID1 Service Pre-install +# eSignet 1.7.1 - eSignet MOSIPID Service Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-mosipid1 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid1, -# and patches the captcha deployment with the MOSIPID1 secret key. +# Wrapper: sets ESIGNET_NS=esignet-mosipid, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-mosipid secret +# in the captcha namespace from workflow env vars, copies it to esignet-mosipid, +# and patches the captcha deployment with the MOSIPID secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY must be set}" -MOSIPID1_POSTGRES_PASS="${MOSIPID1_POSTGRES_PASSWORD:?ERROR: MOSIPID1_POSTGRES_PASSWORD must be set}" -MOSIPID1_KC_ADMIN_PASS="${MOSIPID1_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID1_KEYCLOAK_ADMIN_PASSWORD must be set}" +CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY must be set}" +MOSIPID_POSTGRES_PASS="${MOSIPID_POSTGRES_PASSWORD:?ERROR: MOSIPID_POSTGRES_PASSWORD must be set}" +MOSIPID_KC_ADMIN_PASS="${MOSIPID_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID_KEYCLOAK_ADMIN_PASSWORD must be set}" "$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" -# Create MOSIPID1-specific esignet-global — same domain_name, but esignet/signup hosts differ +# Create MOSIPID-specific esignet-global — same domain_name, but esignet/signup hosts differ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-mosipid1.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-mosipid.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-mosipid1.${domain_name}" \ + --from-literal=mosip-signup-host="signup-mosipid.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - -# Override postgres-config with MOSIPID1-specific DB values +# Override postgres-config with MOSIPID-specific DB values kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid1","database-username":"esignetuser_mosipid1"}}' + -p '{"data":{"database-name":"mosip_esignet_mosipid","database-username":"esignetuser_mosipid"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then @@ -44,50 +44,66 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-mosipid1 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid1 \ +echo "Creating esignet-captcha-mosipid secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-mosipid1 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-mosipid1 "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-mosipid secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-mosipid "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETMOSIPID secret key" + +# Remove stale pre-consolidation env var names if still present, so they don't +# linger pointing at secrets that no longer exist (esignet-mosipid1 was renamed +# to esignet-mosipid; esignet-mosipid2 was removed). +for OLD_NAME in MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1 MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2; do + OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "$OLD_NAME" | cut -d: -f1 || echo "") + if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale $OLD_NAME env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" + fi +done -echo "Patching captcha deployment with ESIGNETMOSIPID1 secret key" ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid1", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID already exists." fi -# --- postgres-postgresql-mosipid1 secret (MOSIPID1 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid1 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid1 \ - --from-literal=postgres-password="${MOSIPID1_POSTGRES_PASS}" \ +# --- postgres-postgresql-mosipid secret (MOSIPID remote postgres password) --- +echo "Creating postgres-postgresql-mosipid secret in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid \ + --from-literal=postgres-password="${MOSIPID_POSTGRES_PASS}" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-host-mosipid1 CM (external URL points to MOSIPID1 Keycloak) --- -echo "Creating keycloak-host-mosipid1 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid1 \ - --from-literal=keycloak-external-host="iam.${mosipid1_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid1_domain_name}" \ +# --- keycloak-host-mosipid CM (external URL points to MOSIPID Keycloak) --- +echo "Creating keycloak-host-mosipid configmap in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid \ + --from-literal=keycloak-external-host="iam.${mosipid_domain_name}" \ + --from-literal=keycloak-external-url="https://iam.${mosipid_domain_name}" \ --from-literal=keycloak-internal-host="keycloak.keycloak" \ --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-client-secrets-mosipid1: fetch all confidential clients from MOSIPID1 Keycloak --- -KC_HOST="iam.${mosipid1_domain_name}" +# --- keycloak-client-secrets-mosipid: fetch all confidential clients from MOSIPID Keycloak --- +KC_HOST="iam.${mosipid_domain_name}" REALM="mosip" echo "Fetching admin token from $KC_HOST" TOKEN_RESPONSE=$(curl -sf -X POST \ "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID1_KC_ADMIN_PASS}") + -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID_KC_ADMIN_PASS}") ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 @@ -116,12 +132,12 @@ while IFS= read -r client_json; do done < <(echo "$CLIENTS" | jq -c '.[]') if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID1 Keycloak" >&2; exit 1 + echo "❌ No client secrets fetched from MOSIPID Keycloak" >&2; exit 1 fi -echo "Creating keycloak-client-secrets-mosipid1 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid1 \ +echo "Creating keycloak-client-secrets-mosipid in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid \ "${SECRET_ARGS[@]}" \ --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid1 created" +echo "✓ keycloak-client-secrets-mosipid created" -echo "eSignet MOSIPID1 pre-install completed." +echo "eSignet MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh deleted file mode 100755 index 4580db97e..000000000 --- a/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh +++ /dev/null @@ -1,127 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID2 Service Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-mosipid2 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid2, -# and patches the captcha deployment with the MOSIPID2 secret key. -# ============================================================================= -set -euo pipefail - -export ESIGNET_NS="esignet-mosipid2" -CAPTCHA_NS="captcha" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY must be set}" -MOSIPID2_POSTGRES_PASS="${MOSIPID2_POSTGRES_PASSWORD:?ERROR: MOSIPID2_POSTGRES_PASSWORD must be set}" -MOSIPID2_KC_ADMIN_PASS="${MOSIPID2_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID2_KEYCLOAK_ADMIN_PASSWORD must be set}" - -"$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" - -# Create MOSIPID2-specific esignet-global — same domain_name, but esignet/signup hosts differ -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-mosipid2.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-mosipid2.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - - -# Override postgres-config with MOSIPID2-specific DB values -kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid2","database-username":"esignetuser_mosipid2"}}' - -# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" -fi - -echo "Creating esignet-captcha-mosipid2 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid2 \ - --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying esignet-captcha-mosipid2 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-mosipid2 "$CAPTCHA_NS" "$ESIGNET_NS" - -echo "Patching captcha deployment with ESIGNETMOSIPID2 secret key" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2')].name}" 2>/dev/null || echo "") -if [[ -z "$ENV_VAR_EXISTS" ]]; then - kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid2", "key": "esignet-captcha-secret-key"}}}}]' -else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2 already exists." -fi - -# --- postgres-postgresql-mosipid2 secret (MOSIPID2 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid2 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid2 \ - --from-literal=postgres-password="${MOSIPID2_POSTGRES_PASS}" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-host-mosipid2 CM (external URL points to MOSIPID2 Keycloak) --- -echo "Creating keycloak-host-mosipid2 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid2 \ - --from-literal=keycloak-external-host="iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-internal-host="keycloak.keycloak" \ - --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ - --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-client-secrets-mosipid2: fetch all confidential clients from MOSIPID2 Keycloak --- -KC_HOST="iam.${mosipid2_domain_name}" -REALM="mosip" - -echo "Fetching admin token from $KC_HOST" -TOKEN_RESPONSE=$(curl -sf -X POST \ - "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ - -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID2_KC_ADMIN_PASS}") -ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') -if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then - echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 -fi -echo "✓ Admin token obtained" - -echo "Fetching all clients from realm $REALM on $KC_HOST" -CLIENTS=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients?max=500" \ - -H "Authorization: Bearer $ADMIN_TOKEN") - -SECRET_ARGS=() -while IFS= read -r client_json; do - client_id=$(echo "$client_json" | jq -r '.clientId') - uuid=$(echo "$client_json" | jq -r '.id') - auth_type=$(echo "$client_json" | jq -r '.clientAuthenticatorType') - is_public=$(echo "$client_json" | jq -r '.publicClient') - [[ "$auth_type" != "client-secret" || "$is_public" == "true" ]] && continue - secret_val=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients/${uuid}/client-secret" \ - -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.value // empty') - [[ -z "$secret_val" || "$secret_val" == "null" ]] && continue - key=$(echo "$client_id" | tr '-' '_')_secret - SECRET_ARGS+=("--from-literal=${key}=${secret_val}") - echo " ✓ $client_id" -done < <(echo "$CLIENTS" | jq -c '.[]') - -if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID2 Keycloak" >&2; exit 1 -fi -echo "Creating keycloak-client-secrets-mosipid2 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid2 \ - "${SECRET_ARGS[@]}" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid2 created" - -echo "eSignet MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh index 811b19841..42357fd22 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh @@ -10,7 +10,7 @@ KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" # All esignet-mock namespaces that need keycloak resources -ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird) +ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid esignet-sunbird) echo "================================================" echo "eSignet 1.7.1 - Keycloak Init Post-install" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh similarity index 69% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh index 001e00f21..86300fb61 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh @@ -1,10 +1,10 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID1 Pre-install +# eSignet 1.7.1 - Mock Relying Party Service MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh deleted file mode 100755 index b8cbdf9fa..000000000 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID2 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service -# preinstall (creates private key secrets in the target namespace). -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh index dd3affbea..c00337b89 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh @@ -1,16 +1,16 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install +# eSignet 1.7.1 - Mock Relying Party UI MOSIPID Pre-install # ============================================================================= -# Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid1 namespace before UI deployment. +# Ensures esignet-mosipid namespace exists and verifies mock-relying-party-service +# is available in the esignet-mosipid namespace before UI deployment. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid1" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install" +echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - @@ -21,4 +21,4 @@ else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." fi -echo "Mock relying party UI MOSIPID1 pre-install completed." +echo "Mock relying party UI MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh deleted file mode 100755 index ec8551819..000000000 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install -# ============================================================================= -# Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid2 namespace before UI deployment. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-mosipid2" - -echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install" -echo "================================================" - -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service &>/dev/null; then - echo "Mock relying party service found in $ESIGNET_NS." -else - echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." -fi - -echo "Mock relying party UI MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh index 6a93a51ed..f7e4aac72 100755 --- a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID1 Pre-install +# eSignet 1.7.1 - OIDC UI MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh deleted file mode 100755 index 6afd2350d..000000000 --- a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID2 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base oidc-ui preinstall. -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh similarity index 62% rename from Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh index c5faefc5c..ecea9f0b0 100755 --- a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh @@ -1,45 +1,45 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install +# eSignet 1.7.1 - PMS Partner MOSIPID Pre-install # ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid1 namespace. +# Creates the Istio Gateway for pms-partner in esignet-mosipid namespace. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid1" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install" +echo "eSignet 1.7.1 - PMS Partner MOSIPID Pre-install" echo "================================================" kubectl apply -f - <- - {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': - 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': - 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', - 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': - 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': - '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': - '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': - 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': - '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG - - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED - value: "" - - name: MOSIP_ESIGNET_CAPTCHA_URL - value: http://captcha.captcha - - name: "MOSIP_ESIGNET_MISP_KEY" - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key - From 976c44bcbb3ad717c6eea39a4e0bdd6c15092ade Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:14:05 +0530 Subject: [PATCH 053/127] Consolidate v1.7.1 mosipid1/mosipid2 database entries in external-dsf.yaml Merges mosip_esignet_mosipid1/mosip_esignet_mosipid2 into a single mosip_esignet_mosipid entry (mosipid1's config, matching the consolidation already applied to the DSF and hooks), removing the now-redundant mosipid2 database provisioning entry. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../dsf/esignet-standalone/external-dsf.yaml | 54 +++++++------------ 1 file changed, 19 insertions(+), 35 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index a956215a7..646442d9a 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -114,43 +114,27 @@ apps: databases.mosip_esignet.su.user: "postgres" databases.mosip_esignet.su.secret.name: "postgres-postgresql" databases.mosip_esignet.su.secret.key: "postgres-password" - databases.mosip_esignet_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_mosipid1.su.user: "postgres" - databases.mosip_esignet_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid1.su.secret.key: "postgres-password" + databases.mosip_esignet_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_mosipid.defaultDb: "postgres" + databases.mosip_esignet_mosipid.su.user: "postgres" + databases.mosip_esignet_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_mosipid.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- - # esignet-mosipid1 namespace (plugin 2 - mosip-identity) + # esignet-mosipid namespace (plugin 2 - mosip-identity) # --------------------------------------------------------------------------- - databases.mosip_esignet_mosipid1.enabled: "true" - databases.mosip_esignet_mosipid1.scriptsDir: "mosip_esignet" - databases.mosip_esignet_mosipid1.dbName: "mosip_esignet_mosipid1" - databases.mosip_esignet_mosipid1.dbUser: "esignetuser_mosipid1" - databases.mosip_esignet_mosipid1.branch: "develop" - databases.mosip_esignet_mosipid1.host: "postgres.${domain_name}" - databases.mosip_esignet_mosipid1.port: ${esignet_db_port} - databases.mosip_esignet_mosipid1.dml: 1 - databases.mosip_esignet_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_mosipid1.su.user: "postgres" - databases.mosip_esignet_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid1.su.secret.key: "postgres-password" - # --------------------------------------------------------------------------- - # esignet-mosipid2 namespace (plugin 2 - mosip-identity) - # --------------------------------------------------------------------------- - databases.mosip_esignet_mosipid2.enabled: "true" - databases.mosip_esignet_mosipid2.scriptsDir: "mosip_esignet" - databases.mosip_esignet_mosipid2.dbName: "mosip_esignet_mosipid2" - databases.mosip_esignet_mosipid2.dbUser: "esignetuser_mosipid2" - databases.mosip_esignet_mosipid2.branch: "develop" - databases.mosip_esignet_mosipid2.host: "postgres.${domain_name}" - databases.mosip_esignet_mosipid2.port: ${esignet_db_port} - databases.mosip_esignet_mosipid2.dml: 1 - databases.mosip_esignet_mosipid2.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid2.defaultDb: "postgres" - databases.mosip_esignet_mosipid2.su.user: "postgres" - databases.mosip_esignet_mosipid2.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid2.su.secret.key: "postgres-password" + databases.mosip_esignet_mosipid.enabled: "true" + databases.mosip_esignet_mosipid.scriptsDir: "mosip_esignet" + databases.mosip_esignet_mosipid.dbName: "mosip_esignet_mosipid" + databases.mosip_esignet_mosipid.dbUser: "esignetuser_mosipid" + databases.mosip_esignet_mosipid.branch: "develop" + databases.mosip_esignet_mosipid.host: "postgres.${domain_name}" + databases.mosip_esignet_mosipid.port: ${esignet_db_port} + databases.mosip_esignet_mosipid.dml: 1 + databases.mosip_esignet_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_mosipid.defaultDb: "postgres" + databases.mosip_esignet_mosipid.su.user: "postgres" + databases.mosip_esignet_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_mosipid.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- # esignet-sunbird namespace (plugin 3 - sunbird-rc) # --------------------------------------------------------------------------- From 6d96e24b05379809789b1e78b41ebf16ccad5db5 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:14:22 +0530 Subject: [PATCH 054/127] Simplify eSignet/testrig workflows now that both profiles use one mosipid instance With v1.7.1 esignet-standalone also consolidated to a single mosipid instance, mosipid1_domain_name/mosipid2_domain_name/enable_mosipid2 and the MOSIPID1_*/MOSIPID2_* secrets and vars are no longer needed by either profile. Replaces them with the single mosipid_domain_name input and MOSIPID_* secrets/vars added for the Go profile, now shared by both esignet-standalone and esignet-standalone-2.0.0. Also collapses the per-profile SOFTHSM_PAIRS case statement to one shared list, since both profiles now use identical softhsm release/namespace names. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 157 +++--------------------- .github/workflows/helmsman_testrigs.yml | 61 ++------- 2 files changed, 29 insertions(+), 189 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 77f56a242..046af52db 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -39,21 +39,8 @@ on: description: "PostgreSQL port for eSignet databases (e.g. 5433 for MOSIP platform external postgres)" required: true type: string - mosipid1_domain_name: - description: "MOSIP-ID1 domain name for this environment (e.g. mosipenv1.xyz.net)" - required: false - type: string - enable_mosipid2: - description: "Enable MOSIP-ID2 eSignet instance (deploys softhsm, esignet, oidc-ui, mock-rp for mosipid2)" - required: false - default: false - type: boolean - mosipid2_domain_name: - description: "MOSIP-ID2 domain name for this environment (e.g. qabase.xyz.net)" - required: false - type: string mosipid_domain_name: - description: "MOSIP-ID domain name for esignet-standalone-2.0.0 (Go) profile only (e.g. qabase.xyz.net)" + description: "MOSIP-ID domain name for this environment (e.g. mosipenv.xyz.net) — required for esignet standalone profiles" required: false type: string env_name: @@ -75,8 +62,6 @@ jobs: name: ${{ github.ref_name }} steps: - name: Validate required variables - env: - IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -95,46 +80,22 @@ jobs: echo "✓ domain_name = $DOMAIN" echo "✓ env_name = $ENV" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1/mosipid2_domain_name are esignet-standalone (v1.7.1) only — that - # profile still runs two separate mosipid1/mosipid2 instances. - # mosipid_domain_name is esignet-standalone-2.0.0 (Go) only — that profile - # consolidates mosipid1+mosipid2 into a single mosipid instance. + # mosipid_domain_name is esignet standalone only (both esignet-standalone + # and esignet-standalone-2.0.0 each run a single consolidated mosipid instance). # Push events always target esignet (path filter); dispatch uses explicit profile input. - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then - MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" - MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" - if [ -z "$MOSIPID1_DOMAIN" ]; then - echo "❌ mosipid1_domain_name is required for esignet-standalone" - exit 1 - fi - if [ "$IN_ENABLE_MOSIPID2" = "true" ] && - [ -z "$MOSIPID2_DOMAIN" ]; then - echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" - exit 1 - fi - echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" - echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" - MOSIPID1_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }}" - MOSIPID2_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }}" - echo "✓ mosipid1_spring_config_label = ${MOSIPID1_SPRING_LABEL:-develop} (esignet standalone, default: develop)" - echo "✓ mosipid2_spring_config_label = ${MOSIPID2_SPRING_LABEL:-develop} (esignet standalone, default: develop)" - fi - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then MOSIPID_DOMAIN="${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }}" if [ -z "$MOSIPID_DOMAIN" ]; then - echo "❌ mosipid_domain_name is required for esignet-standalone-2.0.0" + echo "❌ mosipid_domain_name is required for standalone profiles" exit 1 fi - echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone 2.0.0 / Go)" + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone)" MOSIPID_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }}" - echo "✓ mosipid_spring_config_label = ${MOSIPID_SPRING_LABEL:-develop} (esignet standalone 2.0.0, default: develop)" - fi - if [ -n "$PROFILE" ] && [ "$PROFILE" != "esignet-standalone" ] && [ "$PROFILE" != "esignet-standalone-2.0.0" ]; then - MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" - MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" + echo "✓ mosipid_spring_config_label = ${MOSIPID_SPRING_LABEL:-develop} (esignet standalone, default: develop)" + else MOSIPID_PROVIDED="${{ github.event.inputs.mosipid_domain_name }}" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ] || [ -n "$MOSIPID_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name / mosipid_domain_name are only used for esignet standalone profiles — ignoring for profile=$PROFILE" + if [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid_domain_name is only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -149,11 +110,8 @@ jobs: KUBECTL_PATH: ${{ github.workspace }}/.local/bin/kubectl domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} - mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} - mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} - MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} # All secrets below are ENVIRONMENT secrets (not repository secrets) # Configure them in: Repository → Settings → Environments → → Secrets # Mock Relying Party Service secrets (base64 encoded PEM) @@ -162,20 +120,10 @@ jobs: # eSignet Captcha secrets (plain text from Google reCAPTCHA) ESIGNET_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }} ESIGNET_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }} - # Per-namespace captcha secrets — required for esignet standalone profile only - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY }} - ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }} - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }} - ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }} - # mosipid captcha secret — required for esignet-standalone-2.0.0 (Go) profile only + # mosipid captcha secret — required for esignet standalone profiles ESIGNET_MOSIPID_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }} ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }} - # MOSIPID1 / MOSIPID2 remote Keycloak admin + Postgres passwords (esignet-standalone) - MOSIPID1_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID1_KEYCLOAK_ADMIN_PASSWORD }} - MOSIPID2_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID2_KEYCLOAK_ADMIN_PASSWORD }} - MOSIPID1_POSTGRES_PASSWORD: ${{ secrets.MOSIPID1_POSTGRES_PASSWORD }} - MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} - # MOSIPID remote Keycloak admin + Postgres password (esignet-standalone-2.0.0 / Go) + # MOSIPID remote Keycloak admin + Postgres password (esignet standalone profiles) MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD }} MOSIPID_POSTGRES_PASSWORD: ${{ secrets.MOSIPID_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} @@ -183,8 +131,6 @@ jobs: # Spring config label per namespace — controls which Git branch/tag the config-server uses # Set as Environment Variables in Repository → Settings → Environments → → Variables # If unset, hooks default to 'develop' - ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }} - ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }} ESIGNET_MOSIPID_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }} # Cluster access secrets KUBECONFIG_SECRET: ${{ secrets.KUBECONFIG }} @@ -228,8 +174,6 @@ jobs: } save_var "DOMAIN_NAME" "${{ github.event.inputs.domain_name }}" save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" - save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" - save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "ENV_NAME" "${{ github.event.inputs.env_name }}" @@ -242,10 +186,6 @@ jobs: echo "::add-mask::${{ secrets.CLUSTER_WIREGUARD_WG0 }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" @@ -422,60 +362,23 @@ jobs: fi # Per-namespace captcha secrets — only required for esignet standalone profiles - if [ "$PROFILE" = "esignet-standalone" ]; then - echo "--- Validating esignet standalone mosipid1 captcha secrets ---" - for var in ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY \ - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet standalone)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - echo "--- Validating esignet standalone mosipid1 postgres + keycloak secrets ---" - for var in MOSIPID1_POSTGRES_PASSWORD MOSIPID1_KEYCLOAK_ADMIN_PASSWORD; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet standalone)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - if [ "$MOSIPID2_ENABLED" = "true" ]; then - echo "--- Validating mosipid2 captcha + postgres + keycloak secrets ---" - for var in ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY \ - MOSIPID2_POSTGRES_PASSWORD MOSIPID2_KEYCLOAK_ADMIN_PASSWORD; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required when enable_mosipid2=true)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - else - echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" - fi - elif [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then - echo "--- Validating esignet standalone 2.0.0 (Go) mosipid captcha secrets ---" + if [[ "$PROFILE" == esignet-standalone* ]]; then + echo "--- Validating esignet standalone mosipid captcha secrets ---" for var in ESIGNET_MOSIPID_CAPTCHA_SITE_KEY ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY \ ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do val="${!var:-}" if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet standalone 2.0.0)" + echo "❌ $var secret is not configured (required for esignet standalone)" MISSING_SECRETS=1 else echo "✅ $var is configured" fi done - echo "--- Validating esignet standalone 2.0.0 (Go) mosipid postgres + keycloak secrets ---" + echo "--- Validating esignet standalone mosipid postgres + keycloak secrets ---" for var in MOSIPID_POSTGRES_PASSWORD MOSIPID_KEYCLOAK_ADMIN_PASSWORD; do val="${!var:-}" if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet standalone 2.0.0)" + echo "❌ $var secret is not configured (required for esignet standalone)" MISSING_SECRETS=1 else echo "✅ $var is configured" @@ -495,15 +398,7 @@ jobs: echo " - MOCK_RELYING_PARTY_JWE_PRIVATE_KEY (base64 encoded PEM)" echo " - ESIGNET_CAPTCHA_SITE_KEY (reCAPTCHA site key - plain text)" echo " - ESIGNET_CAPTCHA_SECRET_KEY (reCAPTCHA secret key - plain text)" - if [ "$PROFILE" = "esignet-standalone" ]; then - echo " - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY" - echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" - echo " - MOSIPID1_POSTGRES_PASSWORD / MOSIPID1_KEYCLOAK_ADMIN_PASSWORD" - if [ "$MOSIPID2_ENABLED" = "true" ]; then - echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" - echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" - fi - elif [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + if [[ "$PROFILE" == esignet-standalone* ]]; then echo " - ESIGNET_MOSIPID_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY" echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" echo " - MOSIPID_POSTGRES_PASSWORD / MOSIPID_KEYCLOAK_ADMIN_PASSWORD" @@ -608,8 +503,6 @@ jobs: - name: Show deployment variables run: | echo "domain_name = $domain_name" - echo "mosipid1_domain_name = $mosipid1_domain_name" - echo "mosipid2_domain_name = $mosipid2_domain_name" echo "mosipid_domain_name = $mosipid_domain_name" echo "env_name = $env_name" @@ -649,17 +542,7 @@ jobs: # Fix: skip softhsm upgrade on re-runs so the PIN in the secret never changes. SKIP_RELEASES_ARG="" if [[ "$PROFILE" == esignet-standalone* ]]; then - case "$PROFILE" in - esignet-standalone) - SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid1:esignet-mosipid1" "esignet-softhsm-mosipid2:esignet-mosipid2" "esignet-softhsm-sunbird:esignet-sunbird") - ;; - esignet-standalone-2.0.0) - SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid:esignet-mosipid" "esignet-softhsm-sunbird:esignet-sunbird") - ;; - *) - SOFTHSM_PAIRS=() - ;; - esac + SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid:esignet-mosipid" "esignet-softhsm-sunbird:esignet-sunbird") SKIP_RELEASES="" for pair in "${SOFTHSM_PAIRS[@]}"; do release="${pair%%:*}" @@ -700,7 +583,7 @@ jobs: echo "Commit: ${{ github.sha }}" echo "" echo "Namespaces created/updated:" - kubectl get ns esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-mosipid esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" + kubectl get ns esignet-mock esignet-mosipid esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" echo "" echo "eSignet pods status:" kubectl get pods -n esignet-mock 2>/dev/null || echo "esignet-mock namespace not ready" diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 93e5f52d1..cdd80f7f9 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -25,21 +25,8 @@ on: description: "Domain name for this environment (e.g. example.xyz.net)" required: true type: string - mosipid1_domain_name: - description: "MOSIP-ID1 domain name (e.g. mosipenv1.xyz.net) — required for esignet profile" - required: false - type: string - enable_mosipid2: - description: "Enable MOSIP-ID2 testrig (only needed if mosipid2 eSignet instance is enabled)" - required: false - default: false - type: boolean - mosipid2_domain_name: - description: "MOSIP-ID2 domain name (e.g. mosipenv2.xyz.net) — required only when enable_mosipid2 is set" - required: false - type: string mosipid_domain_name: - description: "MOSIP-ID domain name for esignet-standalone-2.0.0 (Go) profile only (e.g. mosipenv.xyz.net)" + description: "MOSIP-ID domain name (e.g. mosipenv.xyz.net) — required for esignet standalone profiles" required: false type: string db_port: @@ -78,11 +65,6 @@ jobs: steps: - name: Validate required variables env: - IN_MOSIPID1_DOMAIN: ${{ github.event.inputs.mosipid1_domain_name }} - IN_MOSIPID2_DOMAIN: ${{ github.event.inputs.mosipid2_domain_name }} - VAR_MOSIPID1_DOMAIN: ${{ vars.MOSIPID1_DOMAIN_NAME }} - VAR_MOSIPID2_DOMAIN: ${{ vars.MOSIPID2_DOMAIN_NAME }} - IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} IN_MOSIPID_DOMAIN: ${{ github.event.inputs.mosipid_domain_name }} VAR_MOSIPID_DOMAIN: ${{ vars.MOSIPID_DOMAIN_NAME }} run: | @@ -109,40 +91,20 @@ jobs: echo "✓ slack_channel_name = $SLACK_CH" echo "✓ db_port = $DB_PORT" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1/mosipid2_domain_name are esignet-standalone (v1.7.1) only — that - # profile still runs two separate mosipid1/mosipid2 instances. - # mosipid_domain_name is esignet-standalone-2.0.0 (Go) only — that profile - # consolidates mosipid1+mosipid2 into a single mosipid instance. + # mosipid_domain_name is esignet standalone only (both esignet-standalone + # and esignet-standalone-2.0.0 each run a single consolidated mosipid instance). # Push events always target the esignet profile (path filter); dispatch uses explicit profile input. - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then - MOSIPID1_DOMAIN="${IN_MOSIPID1_DOMAIN:-$VAR_MOSIPID1_DOMAIN}" - MOSIPID2_DOMAIN="${IN_MOSIPID2_DOMAIN:-$VAR_MOSIPID2_DOMAIN}" - if [ -z "$MOSIPID1_DOMAIN" ]; then - echo "❌ mosipid1_domain_name is required for esignet-standalone" - exit 1 - fi - if [ "$IN_ENABLE_MOSIPID2" = "true" ] && - [ -z "$MOSIPID2_DOMAIN" ]; then - echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" - exit 1 - fi - echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" - echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" - fi - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then MOSIPID_DOMAIN="${IN_MOSIPID_DOMAIN:-$VAR_MOSIPID_DOMAIN}" if [ -z "$MOSIPID_DOMAIN" ]; then - echo "❌ mosipid_domain_name is required for esignet-standalone-2.0.0" + echo "❌ mosipid_domain_name is required for standalone profiles" exit 1 fi - echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone 2.0.0 / Go)" - fi - if [ -n "$PROFILE" ] && [ "$PROFILE" != "esignet-standalone" ] && [ "$PROFILE" != "esignet-standalone-2.0.0" ]; then - MOSIPID1_PROVIDED="$IN_MOSIPID1_DOMAIN" - MOSIPID2_PROVIDED="$IN_MOSIPID2_DOMAIN" + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone)" + else MOSIPID_PROVIDED="$IN_MOSIPID_DOMAIN" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ] || [ -n "$MOSIPID_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name / mosipid_domain_name are only used for esignet standalone profiles — ignoring for profile=$PROFILE" + if [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid_domain_name is only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -156,10 +118,7 @@ jobs: PATH: ${{ github.workspace }}/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin KUBECTL_PATH: ${{ github.workspace }}/.local/bin/kubectl domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} - mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} - mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} - MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} db_port: ${{ github.event.inputs.db_port || vars.DB_PORT }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} @@ -202,8 +161,6 @@ jobs: fi } save_var "DOMAIN_NAME" "${{ github.event.inputs.domain_name }}" - save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" - save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "DB_PORT" "${{ github.event.inputs.db_port }}" save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" From b3b773bf0972a3760b57fb2b6d8915a24684ec6d Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:34:29 +0530 Subject: [PATCH 055/127] Consolidate mosipid1/mosipid2 DNS subdomains in esignet-standalone terraform profile The subdomain_public list still enumerated separate mosipid1/mosipid2 (and go-mosipid1/go-mosipid2) subdomains from before both the -go removal and the mosipid1+mosipid2 consolidation were completed in the Helmsman DSF/hooks. Rewrites it to the single, deduplicated subdomain set that matches what both profiles actually configure today (esignet, healthservices, signup, esignet-sunbird, healthservices-sunbird, healthservices-mosipid, esignet-mosipid, pms-mosipid, signup-mosipid), verified against the DSF-configured hostnames in both profiles' esignet-dsf.yaml files. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../aws/infra/profiles/esignet-standalone/aws.tfvars | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index 98b68ff23..644320705 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -77,11 +77,12 @@ enable_rancher_import = true rancher_import_url = "\"\"" # DNS Records to map — only eSignet-relevant subdomains -# Includes hosts for both the esignet-standalone profile and the isolated -# esignet-standalone-2.0.0 profile (suffixed "-go"), since both are deployed -# side-by-side against this same cluster/domain. +# Shared by both the esignet-standalone profile and the esignet-standalone-2.0.0 +# profile — both use identical hostnames (no "-go" suffix, single consolidated +# mosipid instance instead of separate mosipid1/mosipid2), since only one of +# the two profiles is ever live on a given cluster/domain at a time. -subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid1", "esignet-mosipid1", "pms-mosipid1", "signup-mosipid1", "healthservices-mosipid2", "esignet-mosipid2", "pms-mosipid2", "signup-mosipid2", "esignet-go", "healthservices-go", "signup-go", "esignet-go-sunbird", "healthservices-go-sunbird", "healthservices-go-mosipid1", "esignet-go-mosipid1", "pms-go-mosipid1", "signup-go-mosipid1", "healthservices-go-mosipid2", "esignet-go-mosipid2", "pms-go-mosipid2", "signup-go-mosipid2"] +subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid", "esignet-mosipid", "pms-mosipid", "signup-mosipid"] subdomain_internal = ["iam", "activemq", "kafka", "kibana", "postgres", "smtp", "pmp", "minio"] # PostgreSQL Configuration From e4853dfb69ac1ac1bf46ea13855d58bc8eb58bd5 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:34:52 +0530 Subject: [PATCH 056/127] Rewrite mosipid1/mosipid2 documentation to describe the consolidated mosipid instance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updates 7 docs/*.md files that still described the retired two-instance architecture (separate mosipid1/mosipid2 namespaces, the enable_mosipid2 toggle, split MOSIPID1_*/MOSIPID2_* secrets and variables). Several sections needed real restructuring rather than renaming — e.g. the deployment guide's "When do you need mosipid1?" / "When do you need mosipid2?" subsections collapse into one, since mosipid is now always deployed with no toggle, and its "up to 4 instances" framing becomes 3. Also corrects now-stale "-go" references intermixed in the same sentences/tables (separate -go-suffixed namespaces/hostnames, a two-column esignet-standalone vs esignet-standalone-2.0.0 URL table) left over from the earlier, separately-completed -go removal work — both profiles use identical namespaces/hostnames now, so most of these collapse to a single description instead of two parallel ones. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- docs/DSF_CONFIGURATION_GUIDE.md | 12 +- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 201 ++++++-------------- docs/HELMSMAN_DESTROY_GUIDE.md | 4 +- docs/HELMSMAN_EXTERNAL_GUIDE.md | 2 +- docs/HELMSMAN_TESTRIGS_GUIDE.md | 34 ++-- docs/WORKFLOW_GUIDE.md | 30 ++- docs/esignet_README.md | 12 +- 7 files changed, 101 insertions(+), 194 deletions(-) diff --git a/docs/DSF_CONFIGURATION_GUIDE.md b/docs/DSF_CONFIGURATION_GUIDE.md index 5fc532b58..daa5d8ecd 100644 --- a/docs/DSF_CONFIGURATION_GUIDE.md +++ b/docs/DSF_CONFIGURATION_GUIDE.md @@ -539,9 +539,8 @@ apps: #### 1. Test Endpoints -All API endpoints in `testrigs-dsf.yaml` use `${domain_name}` substitution — no manual edits needed. For the eSignet profile, `${mosipid1_domain_name}` and `${mosipid2_domain_name}` are also used for the MOSIP-ID1 and MOSIP-ID2 testrig database hosts. Set these as GitHub Environment Variables: -- `vars.MOSIPID1_DOMAIN_NAME` (e.g. `mosipid1.example.net`) -- `vars.MOSIPID2_DOMAIN_NAME` (e.g. `mosipid2.example.net`) +All API endpoints in `testrigs-dsf.yaml` use `${domain_name}` substitution — no manual edits needed. For the eSignet profile, `${mosipid_domain_name}` is also used for the MOSIP-ID testrig database host. Set this as a GitHub Environment Variable: +- `vars.MOSIPID_DOMAIN_NAME` (e.g. `mosipid.example.net`) #### 2. Test Data Configuration @@ -692,7 +691,7 @@ apps: - [ ] GitHub Environment Variables set for your branch (`vars.DOMAIN_NAME`, `vars.ENV_NAME`, `vars.CLUSTER_ID`, `vars.SLACK_CHANNEL_NAME`) - [ ] Port variables set: `vars.DB_PORT` (MOSIP platform profiles), `vars.ESIGNET_DB_PORT` (eSignet profile) -- [ ] For eSignet profile: `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME` also set +- [ ] For eSignet profile: `vars.MOSIPID_DOMAIN_NAME` also set - [ ] No manual `` or domain placeholder edits needed in DSF files ### Before Deploying prereq-dsf.yaml @@ -719,7 +718,7 @@ apps: - [ ] All MOSIP/eSignet services running - [ ] Test data branch matches MOSIP version -- [ ] `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME` set (esignet-standalone profile) +- [ ] `vars.MOSIPID_DOMAIN_NAME` set (esignet-standalone profile) --- @@ -795,8 +794,7 @@ apps: | Slack channel | `vars.SLACK_CHANNEL_NAME` | GitHub Environment Variables | Alerting in prereq-dsf | | MOSIP postgres port | `vars.DB_PORT` | GitHub Environment Variables | MOSIP platform external postgres (5433) | | eSignet postgres port | `vars.ESIGNET_DB_PORT` | GitHub Environment Variables | eSignet container postgres (5432) | -| MOSIP-ID1 domain | `vars.MOSIPID1_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID1 testrig hosts | -| MOSIP-ID2 domain | `vars.MOSIPID2_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID2 testrig hosts | +| MOSIP-ID domain | `vars.MOSIPID_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID testrig hosts | **DSF file manual edits (one-time per environment):** diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 8d8e29d8d..70afb2730 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -4,20 +4,20 @@ This guide walks you through deploying eSignet standalone on your Kubernetes clu You do **not** need to run any commands on your local machine — everything runs in the cloud via GitHub workflows. **What gets deployed:** -- Up to 4 eSignet instances (esignet, esignet-mosipid1, esignet-mosipid2, esignet-sunbird) — **mosipid1 is enabled by default; mosipid2 is optional** -- OIDC UI for each enabled instance +- 3 eSignet instances (esignet, esignet-mosipid, esignet-sunbird) — all enabled by default +- OIDC UI for each instance - Mock Relying Party service and UI - Supporting infrastructure: Postgres, Redis, Kafka, Keycloak, SoftHSM, Captcha, MinIO **Estimated time:** ~90–120 minutes end to end (Terraform ~30 min, external services ~20 min, eSignet ~25 min). -> **A second, isolated profile — `esignet-standalone-2.0.0`** — is also available in the `profile` dropdown of -> `helmsman_esignet.yml`, `helmsman_testrigs.yml`, and `helmsman_signup.yml`. It deploys its own namespaces, Helm -> releases, hostnames (e.g. `esignet-go-mock`, `esignet-go-mosipid1`), and databases, so it can run side by side -> with `esignet-standalone` in the same cluster without colliding. It shares the same external infrastructure -> (Postgres server, Keycloak, Redis, Kafka, Minio, Captcha instances) and Terraform profile — deploy/manage those via `helmsman_external.yml` and -> Terraform using the `esignet-standalone` profile as usual; there is no separate `esignet-standalone-2.0.0` entry -> for either of those. +> **A second, isolated profile — `esignet-standalone-2.0.0`** (the Go rewrite of eSignet) — is also available in +> the `profile` dropdown of `helmsman_esignet.yml`, `helmsman_testrigs.yml`, and `helmsman_signup.yml`. It deploys +> its own Helm releases and databases under **the same namespaces and hostnames** as `esignet-standalone` — the +> two profiles are not meant to run side by side on the same cluster/domain, only one at a time. It shares the +> same external infrastructure (Postgres server, Keycloak, Redis, Kafka, Minio, Captcha instances) and Terraform +> profile — deploy/manage those via `helmsman_external.yml` and Terraform using the `esignet-standalone` profile +> as usual; there is no separate `esignet-standalone-2.0.0` entry for either of those. --- @@ -37,50 +37,28 @@ You do **not** need to run any commands on your local machine — everything run - [Step 4 — Deploy Testrigs (optional)](#step-4--deploy-testrigs-optional) 5. [Re-deploying or Re-running](#4-re-deploying-or-re-running) 6. [Verifying Deployment](#5-verifying-deployment) -7. [MOSIP ID Plugin Onboarding (mosipid1 / mosipid2)](#6-mosip-id-plugin-onboarding-mosipid1--mosipid2) +7. [MOSIP ID Plugin Onboarding (mosipid)](#6-mosip-id-plugin-onboarding-mosipid) --- ## 0. Understanding the eSignet Instances -This deployment can run up to **4 separate eSignet instances** on the same cluster, each isolated in its own Kubernetes namespace. Think of each instance as a completely independent eSignet service — it has its own database, its own Keycloak clients, its own domain name, and its own identity plugin. +This deployment runs **3 separate eSignet instances** on the same cluster, each isolated in its own Kubernetes namespace. Think of each instance as a completely independent eSignet service — it has its own database, its own Keycloak clients, its own domain name, and its own identity plugin. | Instance | Namespace | What it connects to | Enabled by default | |---|---|---|---| | **eSignet (main)** | `esignet-mock` | Mock identity — for demos and testing without a live MOSIP system | Yes | -| **eSignet MOSIP-ID1** | `esignet-mosipid1` | A real MOSIP identity system at `MOSIPID1_DOMAIN_NAME` | **Yes** | -| **eSignet MOSIP-ID2** | `esignet-mosipid2` | A second real MOSIP identity system at `MOSIPID2_DOMAIN_NAME` | No | +| **eSignet MOSIP-ID** | `esignet-mosipid` | A real MOSIP identity system at `MOSIPID_DOMAIN_NAME` | Yes | | **eSignet Sunbird** | `esignet-sunbird` | A Sunbird RC credential registry | Yes | -> **Deploying `esignet-standalone-2.0.0` instead?** Same 4 instances, `-go`-suffixed namespaces: -> `esignet-go-mock`, `esignet-go-mosipid1`, `esignet-go-mosipid2`, `esignet-go-sunbird`. +> **Deploying `esignet-standalone-2.0.0` instead?** Identical 3 instances, same namespaces and hostnames — the +> two profiles are interchangeable, not additive; deploy one or the other, not both, on a given cluster/domain. -### When do you need mosipid1? +### When do you need mosipid? -Use `esignet-mosipid1` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID1_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. +Use `esignet-mosipid` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. -**This is enabled by default** — if you have a MOSIP system to connect to, fill in the `MOSIPID1_DOMAIN_NAME` variable and the related secrets and it will be deployed as part of the normal workflow run. - -### When do you need mosipid2? - -`esignet-mosipid2` is **disabled by default**. Enable it only if you need to run **two eSignet instances that each connect to a different MOSIP environment** on the same cluster — for example, one pointing at a production MOSIP environment and another at a staging one. - -If you only have one MOSIP system to connect to, leave mosipid2 disabled. You do not need to configure any mosipid2 secrets or variables. - -**To enable mosipid2:** - -1. Add the `MOSIPID2_DOMAIN_NAME` environment variable in your GitHub Environment (Section 2B) -2. Add these secrets in your GitHub Environment (Section 2A): - - `ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY` and `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` - - `MOSIPID2_POSTGRES_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` -3. When running the eSignet workflow (Step 2), toggle **`enable_mosipid2`** to `true` and fill in the `mosipid2_domain_name` field - -> No DSF file edits needed — `enable_mosipid2` is a workflow input toggle that controls deployment at runtime. - -> **`esignet-standalone-2.0.0` note:** `MOSIPID1_DOMAIN_NAME` and `MOSIPID2_DOMAIN_NAME` are the same variables -> used by both profiles — if you run `esignet-standalone` and `esignet-standalone-2.0.0` side by side, their -> mosipid1/mosipid2 instances point at the **same** remote MOSIP environment(s). There's no separate `_GO`-suffixed -> domain variable. +**This is enabled by default** — if you have a MOSIP system to connect to, fill in the `MOSIPID_DOMAIN_NAME` variable and the related secrets and it will be deployed as part of the normal workflow run. --- @@ -91,12 +69,11 @@ Complete this checklist before triggering any workflow: - [ ] Kubernetes cluster is up and running - [ ] `KUBECONFIG` file is available for your cluster - [ ] DNS records for all domain names are pointed to your cluster's load balancer -- [ ] Google reCAPTCHA v2 keys are generated — you need **at minimum 4 site/secret key pairs** (one per enabled instance): +- [ ] Google reCAPTCHA v2 keys are generated — you need **4 site/secret key pairs** (one per instance): - one for `esignet-mock` namespace - - one for `esignet-mosipid1` namespace + - one for `esignet-mosipid` namespace - one for `esignet-sunbird` namespace - one for `signup` namespace - - one for `esignet-mosipid2` namespace *(only if you are enabling mosipid2 — see [Section 0](#0-understanding-the-esignet-instances))* - See [reCAPTCHA Setup Guide](RECAPTCHA_SETUP_GUIDE.md) - [ ] Mock Relying Party PEM key pair is generated (client private key + JWE private key) - [ ] GitHub Environment named after your branch (e.g. `MOSIP-44613`) exists under: @@ -168,25 +145,19 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings |---|---| | `MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY` | Base64-encoded PEM — mock relying party client private key | | `MOCK_RELYING_PARTY_JWE_PRIVATE_KEY` | Base64-encoded PEM — JWE userinfo private key | -| `ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid1` namespace | -| `ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid1` namespace | -| `ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | -| `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | +| `ESIGNET_MOSIPID_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid` namespace | +| `ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-sunbird` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-sunbird` namespace | -| `MOSIPID1_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID1 remote MOSIP environment | -| `MOSIPID2_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | -| `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID1 remote MOSIP environment | -| `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | +| `MOSIPID_POSTGRES_PASSWORD` | Postgres superuser password for the remote MOSIP environment | +| `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the remote MOSIP environment | -> ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. +> ⚠️ `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` is the admin password of the **remote** MOSIP-ID Keycloak instance (not the local one deployed by this stack). The preinstall hook calls that Keycloak's REST API to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. > > **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0` -> — there are no separate `_GO`-suffixed GitHub secrets. Internally, the 2.0.0 hooks create differently-named -> Kubernetes secrets (e.g. `esignet-captcha-go`, `esignet-captcha-go-mosipid1`) and patch differently-named env -> vars onto the shared `captcha` deployment (e.g. `MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO`) so both -> profiles can coexist on the same captcha pod — but the underlying reCAPTCHA key **values** you configure here -> are shared between `esignet-standalone` and `esignet-standalone-2.0.0`. +> — both profiles create identically-named Kubernetes secrets (e.g. `esignet-captcha`, `esignet-captcha-mosipid`) +> and patch the same env var names onto the shared `captcha` deployment +> (e.g. `MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET`), since only one profile is ever deployed at a time. **For `helmsman_signup.yml` (set now even though signup is not yet active):** @@ -196,7 +167,7 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the `signup` namespace | > **`esignet-standalone-2.0.0` note:** Same secrets reused here too — signup for the 2.0.0 profile deploys into -> the `signup-go` namespace (vs `signup` for `esignet-standalone`) but shares these same GitHub secret values. +> the same `signup` namespace as `esignet-standalone` and shares these same GitHub secret values. --- @@ -213,10 +184,8 @@ Navigate to: `Repository → Settings → Environments → | `ENV_NAME` | `sandbox` | **Yes** | Short environment label shown on the landing page | | `CLUSTER_ID` | `c-xxxxx` | **Yes** | Rancher cluster ID used by monitoring setup — see [Finding your clusterid](../README.md#step-4a-configure-github-environment-variables) in the root README | | `SLACK_CHANNEL_NAME` | `#mosip-alerts` | **Yes** | Slack channel name for alert notifications | -| `MOSIPID1_DOMAIN_NAME` | `mosipid1.xyz.net` | Optional | Base domain of the MOSIP environment that `esignet-mosipid1` connects to (required if mosipid1 is enabled) | -| `MOSIPID2_DOMAIN_NAME` | `mosipid2.xyz.net` | Optional | Base domain of the second MOSIP environment — only set this if you have enabled mosipid2 (see [Section 0](#0-understanding-the-esignet-instances)) | -| `ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID1 config-server (defaults to `develop`) | -| `ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID2 config-server — only relevant if mosipid2 is enabled (defaults to `develop`) | +| `MOSIPID_DOMAIN_NAME` | `mosipid.xyz.net` | **Yes** | Base domain of the MOSIP environment that `esignet-mosipid` connects to | +| `ESIGNET_MOSIPID_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID config-server (defaults to `develop`) | | `ESIGNET_STANDALONE_MODE` | `true` | Optional | Set to `true` to skip the MOSIP DSF completion check | --- @@ -368,7 +337,7 @@ All pods should show `Running` or `Completed`. ### Step 2 — Deploy eSignet -> **What this does:** Deploys the eSignet application itself — 4 separate instances (main, MOSIP-ID1, MOSIP-ID2, Sunbird), the OIDC login UI for each, and the Mock Relying Party service for testing. +> **What this does:** Deploys the eSignet application itself — 3 separate instances (main, MOSIP-ID, Sunbird), the OIDC login UI for each, and the Mock Relying Party service for testing. > Only run this after Step 1 is fully complete. **GitHub Actions workflow name:** `Deploy eSignet using Helmsman` @@ -386,9 +355,7 @@ All pods should show `Running` or `Completed`. | `delete_existing_jobs` | tick only if re-running after a failure; leave unticked on first deploy | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | | `esignet_db_port` | `5432` | -| `mosipid1_domain_name` | MOSIP-ID1 base domain — e.g. `mosipid1.xyz.net` *(leave blank if not using MOSIP-ID1)* | -| `enable_mosipid2` | toggle `true` to deploy the MOSIP-ID2 eSignet instance; leave `false` to skip it | -| `mosipid2_domain_name` | MOSIP-ID2 base domain — e.g. `mosipid2.xyz.net` *(only required if `enable_mosipid2` is true)* | +| `mosipid_domain_name` | MOSIP-ID base domain — e.g. `mosipid.xyz.net` | | `env_name` | your environment name — e.g. `sandbox` | > **Important:** Always tick `skip_mosip_dsf_check` for standalone eSignet — without it, the workflow waits for a `mosip-dsf=completed` namespace label that will never appear (there is no full MOSIP deployment in this mode), and the workflow will fail. @@ -398,29 +365,16 @@ All pods should show `Running` or `Completed`. ![Deploy eSignet - Helmsman](_images/esignet.png) > **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml` -> instead — it deploys the same 4 instances (main/mock, mosipid1, mosipid2, sunbird) plus their OIDC UIs and mock -> relying party service, but into `-go`-suffixed namespaces (`esignet-go-mock`, `esignet-go-mosipid1`, -> `esignet-go-mosipid2`, `esignet-go-sunbird`) with `-go`-suffixed hostnames (e.g. `esignet-go.sandbox.xyz.net`). -> All other fields (`domain_name`, `mosipid1_domain_name`, `enable_mosipid2`, etc.) work the same way as for -> `esignet-standalone`. You can run both profiles side by side in the same cluster — Step 1 only needs to be run -> once, with `profile: esignet-standalone`. +> instead — it deploys the same 3 instances (main/mock, mosipid, sunbird) plus their OIDC UIs and mock relying +> party service, into the **same namespaces and hostnames** as `esignet-standalone`. All other fields +> (`domain_name`, `mosipid_domain_name`, etc.) work the same way as for `esignet-standalone`. Deploy one profile +> or the other on a given cluster/domain, not both — Step 1 only needs to be run once either way, with +> `profile: esignet-standalone`. **How to know it succeeded:** -For `esignet-standalone`: - -```bash -kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird -# If enable_mosipid2 was set to true: -kubectl get pods -n esignet-mosipid2 -``` - -For `esignet-standalone-2.0.0`: - ```bash -kubectl get pods -n esignet-go-mock && kubectl get pods -n esignet-go-mosipid1 && kubectl get pods -n esignet-go-sunbird -# If enable_mosipid2 was set to true: -kubectl get pods -n esignet-go-mosipid2 +kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid && kubectl get pods -n esignet-sunbird ``` All pods should show `Running`. @@ -438,8 +392,8 @@ All pods should show `Running`. > This section will be updated with full instructions once signup deployment is ready. > > **`esignet-standalone-2.0.0` note:** `helmsman_signup.yml` already lists `esignet-standalone-2.0.0` in its -> `profile` dropdown (deploys into the `signup-go` namespace instead of `signup`), but it's equally not-yet-ready -> for either profile. +> `profile` dropdown (deploys into the same `signup` namespace as `esignet-standalone`), but it's equally +> not-yet-ready for either profile. --- @@ -460,8 +414,7 @@ All pods should show `Running`. | `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — matches whichever profile you deployed in Step 2 | | `mode` | `apply` | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | -| `mosipid1_domain_name` | MOSIP-ID1 base domain *(if MOSIP-ID1 was deployed in Step 2)* | -| `mosipid2_domain_name` | MOSIP-ID2 base domain *(if `enable_mosipid2` was `true` in Step 2)* | +| `mosipid_domain_name` | MOSIP-ID base domain — same value used in Step 2 | | `db_port` *(MOSIP platform external postgres)* | leave blank — not used by the `esignet-standalone` profile | | `esignet_db_port` *(esignet container postgres)* | `5432` | | `env_name` | your environment name | @@ -473,24 +426,10 @@ All pods should show `Running`. **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created: -For `esignet-standalone`: - ```bash kubectl get cronjobs -n esignet-mock -kubectl get cronjobs -n esignet-mosipid1 +kubectl get cronjobs -n esignet-mosipid kubectl get cronjobs -n esignet-sunbird -# If enable_mosipid2 was set to true: -kubectl get cronjobs -n esignet-mosipid2 -``` - -For `esignet-standalone-2.0.0`: - -```bash -kubectl get cronjobs -n esignet-go-mock -kubectl get cronjobs -n esignet-go-mosipid1 -kubectl get cronjobs -n esignet-go-sunbird -# If enable_mosipid2 was set to true: -kubectl get cronjobs -n esignet-go-mosipid2 ``` --- @@ -512,8 +451,7 @@ Run these commands against your cluster to confirm everything is healthy: ```bash # Check all pods across eSignet namespaces kubectl get pods -n esignet-mock -kubectl get pods -n esignet-mosipid1 -kubectl get pods -n esignet-mosipid2 +kubectl get pods -n esignet-mosipid kubectl get pods -n esignet-sunbird # Check Istio virtual services (confirms domain routing) @@ -527,25 +465,24 @@ helm list -n keycloak kubectl get pods --all-namespaces | grep -v Running | grep -v Completed | grep -v Terminating ``` -> **Deployed `esignet-standalone-2.0.0`?** Swap in the `-go` namespaces: `esignet-go-mock`, `esignet-go-mosipid1`, -> `esignet-go-mosipid2`, `esignet-go-sunbird`. `keycloak` is shared, so `helm list -n keycloak` is unchanged. +> **Deployed `esignet-standalone-2.0.0`?** Same namespaces and commands as above — the two profiles share +> identical naming, so there's nothing to swap. -**Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain): +**Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain; identical for both profiles): -| Service | esignet-standalone URL | esignet-standalone-2.0.0 URL | -|---|---|---| -| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | `https://esignet-go.sandbox.xyz.net` | -| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | `https://healthservices-go.sandbox.xyz.net` | -| Keycloak | `https://iam.sandbox.xyz.net` | *(shared — same URL)* | -| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | `https://esignet-go-mosipid1.sandbox.xyz.net` | -| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | `https://esignet-go-mosipid2.sandbox.xyz.net` | -| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | `https://esignet-go-sunbird.sandbox.xyz.net` | +| Service | URL | +|---|---| +| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | +| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | +| Keycloak | `https://iam.sandbox.xyz.net` | +| MOSIP-ID eSignet | `https://esignet-mosipid.sandbox.xyz.net` | +| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | --- -## 6. MOSIP ID Plugin Onboarding (mosipid1 / mosipid2) +## 6. MOSIP ID Plugin Onboarding (mosipid) -> **This section applies only if you are deploying `esignet-mosipid1` or `esignet-mosipid2`** — instances that authenticate citizens against a real MOSIP platform. If you are using only the mock identity system (`esignet-mock`) or Sunbird, skip this section. +> **This section applies only if you are deploying `esignet-mosipid`** — the instance that authenticates citizens against a real MOSIP platform. If you are using only the mock identity system (`esignet-mock`) or Sunbird, skip this section. Onboarding eSignet to a MOSIP identity system involves two phases: **prerequisites** (config changes on the MOSIP platform side) and **manual onboarding** (Postman collection run against the deployed eSignet instance). @@ -553,7 +490,7 @@ Onboarding eSignet to a MOSIP identity system involves two phases: **prerequisit ### Prerequisites — Changes on the MOSIP platform's mosip-config branch -The following changes must be made on **each MOSIP platform's `mosip-config` repository branch** that the esignet-mosipid instance points to (the branch set via `ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL` / `ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL`). +The following changes must be made on the **MOSIP platform's `mosip-config` repository branch** that the esignet-mosipid instance points to (the branch set via `ESIGNET_MOSIPID_SPRING_CONFIG_LABEL`). #### 1. Add eSignet property files @@ -570,30 +507,16 @@ Reference commit: [mosip/mosip-config@e8961a2](https://github.com/mosip/mosip-co The MOSIP Identity Authentication service restricts which domains can call its APIs. Edit `id-authentication-default.properties` in the MOSIP platform's `mosip-config` branch and add your eSignet standalone hostnames to `mosip.ida.allowed.domain.uris`: -**For mosipid1 only:** - ```properties -mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1. -``` - -**For both mosipid1 and mosipid2:** - -```properties -mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-mosipid2. +mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid. ``` Replace `` with your eSignet standalone base domain (e.g. `sandbox.xyz.net`). -> **`esignet-standalone-2.0.0` note:** Since `MOSIPID1_DOMAIN_NAME`/`MOSIPID2_DOMAIN_NAME` are shared between both -> profiles (see [Section 0](#0-understanding-the-esignet-instances)), if you're running `esignet-mosipid1` (v1.7.1) -> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment (and similarly for -> MOSIP-ID2), add **both** hostnames for each shared environment to `mosip.ida.allowed.domain.uris`: -> -> ```properties -> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1.,https://esignet-mosipid2.,https://esignet-go-mosipid2. -> ``` -> -> Otherwise, only add the hostname for whichever profile(s) you actually deployed. +> **`esignet-standalone-2.0.0` note:** `MOSIPID_DOMAIN_NAME` is shared between both profiles (see +> [Section 0](#0-understanding-the-esignet-instances)), and both profiles use the identical +> `esignet-mosipid.` hostname — since only one profile is ever deployed at a time, no extra +> hostname needs to be added here regardless of which profile you're running. Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c) @@ -611,4 +534,4 @@ Once the prerequisites above are complete, follow the manual onboarding steps us **[eSignet Postman Collection — MOSIP ID Plugin Onboarding](https://github.com/mosip/esignet/tree/master/postman-collection#esignet-collection)** -This collection covers partner onboarding, OIDC client registration, and end-to-end flow verification for the MOSIP ID plugin against your deployed `esignet-mosipid1` or `esignet-mosipid2` instance. +This collection covers partner onboarding, OIDC client registration, and end-to-end flow verification for the MOSIP ID plugin against your deployed `esignet-mosipid` instance. diff --git a/docs/HELMSMAN_DESTROY_GUIDE.md b/docs/HELMSMAN_DESTROY_GUIDE.md index 7360848d5..2cd0924cf 100644 --- a/docs/HELMSMAN_DESTROY_GUIDE.md +++ b/docs/HELMSMAN_DESTROY_GUIDE.md @@ -51,9 +51,9 @@ The destroy workflows follow a **reusable workflow pattern**: | Workflow | File | Purpose | Namespaces Affected | | ----------------------------------- | ------------------------------------------ | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **Destroy Testrigs** | `helmsman_testrigs_destroy.yml` | Removes test rig services | `apitestrig`, `dslrig`, `uitestrig` (MOSIP platform); `esignet`, `esignet-mosipid1`, `esignet-mosipid2`, `esignet-sunbird`, `signup` (esignet profile apitestrigs) | +| **Destroy Testrigs** | `helmsman_testrigs_destroy.yml` | Removes test rig services | `apitestrig`, `dslrig`, `uitestrig` (MOSIP platform); `esignet`, `esignet-mosipid`, `esignet-sunbird`, `signup` (esignet profile apitestrigs) | | **Destroy MOSIP Services** | `helmsman_mosip_destroy.yml` | Removes core MOSIP services | `admin`, `apitestrig`, `artifactory`, `config-server`, `dslrig`, `esignet`, `idrepo`, `kernel`, `masterdata`, `packet-manager`, `pmp`, `postgresdb`, `print`, `regproc`, `resident`, `uitestrig` | -| **Destroy eSignet Services** | (use `helmsman_esignet.yml` with `--destroy`) | Removes eSignet stack (esignet profile) | `esignet`, `esignet-mosipid1`, `esignet-mosipid2`, `esignet-sunbird`, `signup`, `kernel` | +| **Destroy eSignet Services** | (use `helmsman_esignet.yml` with `--destroy`) | Removes eSignet stack (esignet profile) | `esignet`, `esignet-mosipid`, `esignet-sunbird`, `signup`, `kernel` | | **Destroy External Services** | `helmsman_external_destroy_external.yml` | Removes external dependencies | `keycloak`, `kafka`, `minio`, `softhsm`, `clamav`, `activemq`, `captcha`, `redis`, `postgres`, `landing-page` | | **Destroy Prerequisites** | `helmsman_external_destroy_prereq.yml` | Removes monitoring and Istio | `cattle-logging-system`, `istio-system`, `monitoring` | diff --git a/docs/HELMSMAN_EXTERNAL_GUIDE.md b/docs/HELMSMAN_EXTERNAL_GUIDE.md index 0cd292106..5c90eef3b 100644 --- a/docs/HELMSMAN_EXTERNAL_GUIDE.md +++ b/docs/HELMSMAN_EXTERNAL_GUIDE.md @@ -23,7 +23,7 @@ Choose the profile that matches your deployment target: | Profile | Use when | |---------|----------| -| `esignet-standalone` | eSignet standalone — up to 4 parallel instances (esignet-mock, esignet-mosipid1, esignet-mosipid2, esignet-sunbird). mosipid2 is optional via `enable_mosipid2` toggle. No full MOSIP stack. | +| `esignet-standalone` | eSignet standalone — 3 parallel instances (esignet-mock, esignet-mosipid, esignet-sunbird). No full MOSIP stack. | | `mosip-platform-1.2.0.x` | Full MOSIP platform with Java 11 | | `mosip-platform-1.2.1.x` | Full MOSIP platform with Java 21 | diff --git a/docs/HELMSMAN_TESTRIGS_GUIDE.md b/docs/HELMSMAN_TESTRIGS_GUIDE.md index 1401d56ef..d171783ed 100644 --- a/docs/HELMSMAN_TESTRIGS_GUIDE.md +++ b/docs/HELMSMAN_TESTRIGS_GUIDE.md @@ -14,11 +14,11 @@ Deploy API, UI, and DSL test rigs after all services are running and partner onb | Profile | What deploys | Namespaces | |---------|-------------|------------| -| `esignet-standalone` | `esignet-apitestrig` into up to 4 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid1`, `esignet-mosipid2` *(if enabled)*, `esignet-sunbird`, `signup` | +| `esignet-standalone` | `esignet-apitestrig` into 3 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid`, `esignet-sunbird`, `signup` | | `mosip-platform-1.2.0.x` | API testrig, UI testrig, DSL testrig | MOSIP testrig namespaces | | `mosip-platform-1.2.1.x` | Same as above | MOSIP testrig namespaces | -> **eSignet standalone (`esignet-standalone` profile):** Requires `mosipid1_domain_name` for the MOSIP-ID1 apitestrig endpoint. `mosipid2_domain_name` is only required if mosipid2 was enabled during eSignet deployment (`enable_mosipid2: true`). +> **eSignet standalone (`esignet-standalone` profile):** Requires `mosipid_domain_name` for the MOSIP-ID apitestrig endpoint. --- @@ -74,10 +74,9 @@ No additional secrets required — MinIO root password is read automatically fro | Input | Description | Example | |-------|-------------|---------| -| `mosipid1_domain_name` | Domain for the MOSIP-ID1 eSignet instance | `mosipid1.mosip.net` | -| `mosipid2_domain_name` | Domain for the MOSIP-ID2 eSignet instance — only required if mosipid2 was enabled (`enable_mosipid2: true`) during eSignet deployment | `mosipid2.mosip.net` | +| `mosipid_domain_name` | Domain for the MOSIP-ID eSignet instance | `mosipid.mosip.net` | -> If not provided as inputs, values fall back to GitHub Environment Variables: `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME`. +> If not provided as an input, the value falls back to the GitHub Environment Variable `vars.MOSIPID_DOMAIN_NAME`. --- @@ -92,16 +91,15 @@ No additional secrets required — MinIO root password is read automatically fro - **(4)** **Deployment profile to use** — pick the profile you want (e.g., `mosip-platform-1.2.0.x` or `esignet-standalone`). - **(5)** **Choose Helmsman mode: dry-run or apply** — always pick **`apply`**. - **(6)** **Domain name for this environment** — type the web domain this environment should use (e.g., `example.xyz.net`). -- **(7)** **MOSIP-ID1 domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID1 eSignet instance (e.g., `mosipid1.xyz.net`). Leave blank for MOSIP platform profiles. -- **(8)** **QA base domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID2 eSignet instance (e.g., `mosipid2.xyz.net`). Leave blank for MOSIP platform profiles. -- **(9)** **PostgreSQL port for MOSIP platform external postgres** — only fill this in if you picked a `mosip-platform-*` profile in step 4. Type `5433` (or whatever port your external PostgreSQL uses). -- **(10)** **PostgreSQL port for esignet standalone container postgres** — only fill this in if you picked the `esignet-standalone` profile in step 4. Type `5432`. -- **(11)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). -- **(12)** **Slack channel name for alerting** (optional) — the Slack channel that should receive test result notifications (e.g., `#mosip-alerts`). Leave blank if you don't want Slack alerts. -- **(13)** **Slack webhook URL for alerting** (optional) — leave this blank; it's normally already saved as the `SLACK_WEBHOOK_URL` secret in your GitHub environment. -- **(14)** Click the green **Run workflow** button to start the deployment. +- **(7)** **MOSIP-ID domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID eSignet instance (e.g., `mosipid.xyz.net`). Leave blank for MOSIP platform profiles. +- **(8)** **PostgreSQL port for MOSIP platform external postgres** — only fill this in if you picked a `mosip-platform-*` profile in step 4. Type `5433` (or whatever port your external PostgreSQL uses). +- **(9)** **PostgreSQL port for esignet standalone container postgres** — only fill this in if you picked the `esignet-standalone` profile in step 4. Type `5432`. +- **(10)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). +- **(11)** **Slack channel name for alerting** (optional) — the Slack channel that should receive test result notifications (e.g., `#mosip-alerts`). Leave blank if you don't want Slack alerts. +- **(12)** **Slack webhook URL for alerting** (optional) — leave this blank; it's normally already saved as the `SLACK_WEBHOOK_URL` secret in your GitHub environment. +- **(13)** Click the green **Run workflow** button to start the deployment. -> **Note:** Steps 7–10 all appear in the form regardless of which profile you picked — fill in only the ones that match your profile (MOSIP-ID1/MOSIP-ID2 domains for `esignet-standalone`, PostgreSQL port for `mosip-platform-*`) and leave the rest blank. +> **Note:** Steps 7–9 all appear in the form regardless of which profile you picked — fill in only the ones that match your profile (MOSIP-ID domain for `esignet-standalone`, PostgreSQL port for `mosip-platform-*`) and leave the rest blank. > **Important:** Always pass `--keep-untracked-releases` — without it Helmsman will delete releases from previous DSFs (esignet, oidc-ui, etc.) that aren't listed in `testrigs-dsf.yaml`. The workflow handles this automatically. @@ -123,8 +121,7 @@ kubectl get cronjobs -n dslrig # For eSignet standalone kubectl get cronjobs -n esignet -kubectl get cronjobs -n esignet-mosipid1 -kubectl get cronjobs -n esignet-mosipid2 +kubectl get cronjobs -n esignet-mosipid kubectl get cronjobs -n esignet-sunbird ``` @@ -141,7 +138,7 @@ kubectl create job --from=cronjob/cronjob-dslorchestrator-full dslrig-manual-run **3. Trigger eSignet test jobs (eSignet standalone profile)** -The `trigger-test-jobs-esignet.sh` postInstall hook fires automatically after the last testrig deploys — it triggers all cronjobs across all 4 esignet namespaces sequentially and optionally signup/signup-uitestrig if deployed. +The `trigger-test-jobs-esignet.sh` postInstall hook fires automatically after the last testrig deploys — it triggers all cronjobs across all 3 esignet namespaces sequentially and optionally signup/signup-uitestrig if deployed. To trigger manually: @@ -163,8 +160,7 @@ kubectl get pods -n dslrig # Check testrig pods (eSignet standalone) kubectl get pods -n esignet # esignet-apitestrig cronjob -kubectl get pods -n esignet-mosipid1 -kubectl get pods -n esignet-mosipid2 +kubectl get pods -n esignet-mosipid kubectl get pods -n esignet-sunbird kubectl get pods -n signup # signup-apitestrig (if enabled) ``` diff --git a/docs/WORKFLOW_GUIDE.md b/docs/WORKFLOW_GUIDE.md index b86f68481..3a809b848 100644 --- a/docs/WORKFLOW_GUIDE.md +++ b/docs/WORKFLOW_GUIDE.md @@ -387,18 +387,16 @@ Mode: apply ✅ | **mode** | `apply` | MUST be apply! | | **domain_name** | `sandbox.example.net` | Or set `vars.DOMAIN_NAME` | | **esignet_db_port** | `5432` (esignet) / `5433` (MOSIP platform) | Or set `vars.ESIGNET_DB_PORT` | - | **mosipid1_domain_name** | `mosipid1.example.net` | esignet-standalone profile only — MOSIP-ID1 environment domain | - | **enable_mosipid2** | `false` (default) / `true` | Toggle to deploy MOSIP-ID2 instance; leave `false` to skip | - | **mosipid2_domain_name** | `mosipid2.example.net` | Required only if `enable_mosipid2` is `true` | + | **mosipid_domain_name** | `mosipid.example.net` | esignet-standalone profile only — MOSIP-ID environment domain | | **skip_mosip_dsf_check** | `true` for standalone, `false` when MOSIP is deployed | | | **delete_existing_jobs** | `true` when re-running after a failed attempt | Cleans up stale onboarder jobs | -3. **Monitor Progress** (25-35 minutes for esignet-standalone profile with up to 4 instances) +3. **Monitor Progress** (25-35 minutes for esignet-standalone profile with 3 instances) ``` - → SoftHSM (all 4 namespaces) + → SoftHSM (all 3 namespaces) → Config server - → eSignet core (all 4 namespaces in parallel) - → OIDC UI (all 4 namespaces) + → eSignet core (all 3 namespaces in parallel) + → OIDC UI (all 3 namespaces) → Mock identity system → Mock relying party ``` @@ -411,8 +409,7 @@ Mode: apply ✅ **Check Status:** ```bash kubectl get pods -n esignet -kubectl get pods -n esignet-mosipid1 # esignet profile only -kubectl get pods -n esignet-mosipid2 # esignet profile only +kubectl get pods -n esignet-mosipid # esignet profile only kubectl get pods -n esignet-sunbird # esignet profile only ``` @@ -445,14 +442,13 @@ kubectl get pods -n esignet-sunbird # esignet profile only | **profile** | Same as your deployment profile | | | **mode** | `apply` | | | **domain_name** | `sandbox.example.net` | Or `vars.DOMAIN_NAME` | - | **mosipid1_domain_name** | `mosipid1.example.net` | esignet-standalone profile only | - | **mosipid2_domain_name** | `mosipid2.example.net` | esignet-standalone only — required if mosipid2 was enabled | + | **mosipid_domain_name** | `mosipid.example.net` | esignet-standalone profile only | | **db_port** | `5433` | MOSIP platform only | | **esignet_db_port** | `5432` | eSignet profile | 4. **Monitor Progress** (10-20 minutes) ``` - → esignet-apitestrig (esignet profile: 4 instances across all namespaces) + → esignet-apitestrig (esignet profile: 3 instances across all namespaces) → signup-apitestrig (if signup was deployed) → API / DSL / UI test rigs (MOSIP platform profiles) ``` @@ -460,8 +456,7 @@ kubectl get pods -n esignet-sunbird # esignet profile only 5. **Verify CronJobs Created** ```bash kubectl get cronjobs -n esignet - kubectl get cronjobs -n esignet-mosipid1 # esignet profile - kubectl get cronjobs -n esignet-mosipid2 # esignet profile + kubectl get cronjobs -n esignet-mosipid # esignet profile kubectl get cronjobs -n esignet-sunbird # esignet profile ``` @@ -612,8 +607,7 @@ These inputs override the corresponding GitHub Environment Variables for a singl | `clusterid` | `vars.CLUSTER_ID` | Rancher cluster ID | | `db_port` | `vars.DB_PORT` | MOSIP platform postgres port | | `esignet_db_port` | `vars.ESIGNET_DB_PORT` | eSignet postgres port | -| `mosipid1_domain_name` | `vars.MOSIPID1_DOMAIN_NAME` | MOSIP-ID1 environment base domain (esignet profile) | -| `mosipid2_domain_name` | `vars.MOSIPID2_DOMAIN_NAME` | MOSIP-ID2 environment base domain (esignet profile) | +| `mosipid_domain_name` | `vars.MOSIPID_DOMAIN_NAME` | MOSIP-ID environment base domain (esignet profile) | --- @@ -772,10 +766,10 @@ DEPLOYMENT FLOW: └── PostgreSQL, Redis, Kafka, SoftHSM, Keycloak, Captcha, MinIO 4. Helmsman: eSignet [helmsman_esignet.yml, profile=esignet-standalone] - └── 3 instances always (esignet-mock / esignet-mosipid1 / esignet-sunbird) + esignet-mosipid2 if enable_mosipid2=true + └── 3 instances always (esignet-mock / esignet-mosipid / esignet-sunbird) 5. Helmsman: Test Rigs [helmsman_testrigs.yml, profile=esignet-standalone, manual] - └── API testrigs for all 4 esignet namespaces + └── API testrigs for all 3 esignet namespaces └── ✅ Deployment Complete! ``` diff --git a/docs/esignet_README.md b/docs/esignet_README.md index 73ad5b3ba..b38de8828 100644 --- a/docs/esignet_README.md +++ b/docs/esignet_README.md @@ -233,11 +233,9 @@ Custom Helm values are stored in: - **(7)** **Delete existing onboarder jobs before deploy** (checkbox) — only tick this when re-running after a failure. Leave unticked on a first-time deploy. - **(8)** **Domain name for this environment** — type the web domain this environment should use (e.g., `example.xyz.net`). - **(9)** **PostgreSQL port for esignet databases** — type `5432` for eSignet standalone, or `5433` if this is part of a MOSIP platform profile. -- **(10)** **MOSIP-ID1 domain name** *(eSignet standalone only)* — base domain for the MOSIP-ID1 eSignet instance (e.g., `mosipid1.xyz.net`). Leave blank if you're not deploying MOSIP-ID1. -- **(11)** **Enable MOSIP-ID2 eSignet instance** *(eSignet standalone only)* — toggle to `true` to deploy the MOSIP-ID2 instance (softhsm, esignet, oidc-ui, mock-rp). Leave `false` to skip it entirely. -- **(12)** **MOSIP-ID2 domain name** *(eSignet standalone only, required if enable_mosipid2 is true)* — base domain for the MOSIP-ID2 eSignet instance (e.g., `mosipid2.xyz.net`). -- **(13)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). -- **(14)** Click the green **Run workflow** button to start the deployment. +- **(10)** **MOSIP-ID domain name** *(eSignet standalone only)* — base domain for the MOSIP-ID eSignet instance (e.g., `mosipid.xyz.net`). Leave blank if you're not deploying MOSIP-ID. +- **(11)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). +- **(12)** Click the green **Run workflow** button to start the deployment. --- @@ -258,9 +256,7 @@ Custom Helm values are stored in: | `mode` | `dry-run` or `apply` | Yes | Always use `apply` — dry-run will fail | | `domain_name` | Your base domain | Yes | Or set `vars.DOMAIN_NAME` in GitHub Environment | | `esignet_db_port` | PostgreSQL port for esignet databases | Yes | `5433` for MOSIP platform external postgres, `5432` for eSignet standalone (or `vars.ESIGNET_DB_PORT`) | -| `mosipid1_domain_name` | Base domain for the MOSIP-ID1 eSignet instance | No | eSignet standalone only — leave blank otherwise (or `vars.MOSIPID1_DOMAIN_NAME`) | -| `enable_mosipid2` | Deploy MOSIP-ID2 eSignet instance | No | Toggle `true` to deploy softhsm, esignet, oidc-ui, mock-rp for mosipid2; default `false` | -| `mosipid2_domain_name` | Base domain for the MOSIP-ID2 eSignet instance | No | Required only if `enable_mosipid2` is `true` (or `vars.MOSIPID2_DOMAIN_NAME`) | +| `mosipid_domain_name` | Base domain for the MOSIP-ID eSignet instance | No | eSignet standalone only — leave blank otherwise (or `vars.MOSIPID_DOMAIN_NAME`) | | `env_name` | Environment name shown on the landing page | Yes | Or set `vars.ENV_NAME` in GitHub Environment | | `skip_mosip_dsf_check` | Skip MOSIP DSF completion check | No | Tick for eSignet standalone deploys; default `false` otherwise | | `delete_existing_jobs` | Delete stale onboarder jobs before deploy | No | Set `true` when re-running after a failure | From 6d1d5c824699bd16e05456c9fb3961771265bf1f Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:54:46 +0530 Subject: [PATCH 057/127] Remove disabled config-server and pms apps from both eSignet standalone profiles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit esignet-config-server, pms-partner-mosipid, and pms-policy-mosipid were already enabled: false in both esignet-standalone and esignet-standalone-2.0.0's esignet-dsf.yaml. Removes the app blocks entirely along with their dedicated hook scripts and values files, rather than leaving disabled dead weight in the DSFs. Also removes the now-dangling partnermanager=pms-mosipid.*/ policymanager=pms-mosipid.* entries from testrigs-dsf.yaml's mosip_components_base_urls (in both profiles), which would otherwise point the apitestrig at a service that no longer exists. Left untouched: the shared external-dsf.yaml's mosip_pms_client_secret Keycloak client-secret provisioning and the PMS_CLIENT_SECRET_KEY/VALUE fetch step in helmsman_esignet.yml — harmless if unused, and removing them would mean re-indexing a 5-entry array shared across profiles, a separate change from this app removal. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 45 ------ .../testrigs-dsf.yaml | 2 +- .../dsf/esignet-standalone/esignet-dsf.yaml | 45 ------ .../dsf/esignet-standalone/testrigs-dsf.yaml | 2 +- .../config-server-esignet-postinstall.sh | 33 ----- .../config-server-esignet-setup.sh | 78 ---------- .../pms-partner-mosipid-preinstall.sh | 45 ------ .../config-server-esignet-postinstall.sh | 33 ----- .../config-server-esignet-setup.sh | 78 ---------- .../pms-partner-mosipid-preinstall.sh | 45 ------ .../utils/config-server-esignet-values.yaml | 139 ------------------ .../config-server-esignet-values-2-0-0.yaml | 139 ------------------ 12 files changed, 2 insertions(+), 682 deletions(-) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh delete mode 100755 Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh delete mode 100755 Helmsman/hooks/esignet-standalone/config-server-esignet-setup.sh delete mode 100755 Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh delete mode 100644 Helmsman/utils/config-server-esignet-values.yaml delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index c11e97a7e..647a9eaef 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -76,19 +76,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh" - esignet-config-server: - namespace: esignet-mock - enabled: false - version: 12.0.1 - chart: mosip/config-server - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml" - wait: true - timeout: 1200 - priority: -15 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh" - postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh" - # --------------------------------------------------------------------------- # eSignet # --------------------------------------------------------------------------- @@ -675,38 +662,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-mosipid: - namespace: esignet-mosipid - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh" - - pms-policy-mosipid: - namespace: esignet-mosipid - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid-gateway" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" - priority: -9 - timeout: 1200 - # --------------------------------------------------------------------------- # Partner Onboarders # --------------------------------------------------------------------------- diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index 94ca20929..a23036792 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -110,7 +110,7 @@ apps: apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};partnermanager=pms-mosipid.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};policymanager=pms-mosipid.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -3 diff --git a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml index 56d5a8fd4..8a5660497 100644 --- a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml @@ -76,19 +76,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-sunbird-setup.sh" - esignet-config-server: - namespace: esignet-mock - enabled: false - version: 12.0.1 - chart: mosip/config-server - valuesFile: "$WORKDIR/utils/config-server-esignet-values.yaml" - wait: true - timeout: 1200 - priority: -15 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/config-server-esignet-setup.sh" - postInstall: "$WORKDIR/hooks/esignet-standalone/config-server-esignet-postinstall.sh" - # --------------------------------------------------------------------------- # eSignet v1.7.1 # --------------------------------------------------------------------------- @@ -447,38 +434,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-mosipid: - namespace: esignet-mosipid - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh" - - pms-policy-mosipid: - namespace: esignet-mosipid - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - esignet-misp-onboarder: namespace: esignet-mock enabled: false diff --git a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml index 2250af730..8acfb445c 100644 --- a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml @@ -110,7 +110,7 @@ apps: apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};partnermanager=pms-mosipid.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};policymanager=pms-mosipid.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -4 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh deleted file mode 100755 index 23d740745..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh +++ /dev/null @@ -1,33 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 2.0.0 (Go) - Config-Server eSignet Post-install -# ============================================================================= -# Copies esignet-config-server-share CM from esignet-mock ns to mosipid/sunbird, -# then patches active_profile_env and spring_config_label_env per namespace -# so each instance points to the correct config server profile and Git label. -# -# Environment variables (set in GitHub Actions workflow): -# ESIGNET_MOSIPID_SPRING_CONFIG_LABEL - Git label for esignet-mosipid (default: develop) -# ============================================================================= -set -euo pipefail - -SOURCE_NS="esignet-mock" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CM_NAME="esignet-config-server-share" - -MOSIPID_SPRING_LABEL="${ESIGNET_MOSIPID_SPRING_CONFIG_LABEL:-develop}" - -echo "================================================" -echo "eSignet 2.0.0 (Go) - Config-Server eSignet Post-install" -echo "================================================" - -for TARGET_NS in esignet-mosipid esignet-sunbird; do - echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" - $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" -done - -echo "Patching $CM_NAME in esignet-mosipid (active_profile_env=mosipid, spring_config_label_env=$MOSIPID_SPRING_LABEL)" -kubectl -n esignet-mosipid patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid\",\"spring_config_label_env\":\"$MOSIPID_SPRING_LABEL\"}}" - -echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh deleted file mode 100755 index ee1798d92..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Config-Server eSignet Pre-install -# ============================================================================= -# Based on: esignet/deploy/config-server/install.sh -# -# Prepares esignet namespace for config-server deployment: -# 1. Ensures namespace exists with Istio injection enabled -# 2. Copies db-common-secrets from postgres ns -# 3. Creates esignet-global ConfigMap from workflow env vars -# (domain_name set by helmsman_esignet.yml; available as shell env var -# in all hooks run within the same workflow step) -# 4. Pre-creates empty esignet-misp-onboarder-key secret as placeholder -# (MISP onboarder at priority -6 writes the real key; config-server is -# restarted by esignet-misp-onboarder-postinstall.sh afterwards) -# -# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart -# installs directly into the esignet namespace, so no cross-namespace copy needed. -# -# NOTE: keycloak resources (keycloak-host, keycloak-env-vars, keycloak, -# keycloak-client-secrets) are NOT copied here. They are populated in all -# esignet namespaces by esignet-postinstall-keycloak-init.sh which runs as -# part of external-dsf (esignet-keycloak-init at priority -11 in keycloak ns). -# By the time esignet-dsf runs, these resources are already present. -# -# Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet) -# domain_name - base domain (set by workflow, e.g. sandbox.example.net) -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" -POSTGRES_NS="postgres" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - Config-Server eSignet Pre-install" -echo "================================================" - -# --- Step 1: Ensure namespace with Istio --- -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite - -# --- Step 2: Copy db-common-secrets --- -# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart -# creates it directly in the esignet namespace as a helm-managed resource. -echo "Copying db-common-secrets from $POSTGRES_NS" -$COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" - -# --- Step 3: Create esignet-global from workflow env vars --- -# domain_name is exported by the helmsman_esignet.yml workflow step -echo "Creating esignet-global configmap (domain_name=${domain_name:-UNSET})" -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "esignet-global created/updated." - -# --- Step 4: Pre-create empty MISP key secret as placeholder --- -# Allows config-server pod to start. Real value written by MISP onboarder (-6). -# esignet-misp-onboarder-postinstall.sh restarts config-server after writing. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created." -else - echo "esignet-misp-onboarder-key already exists, skipping placeholder." -fi - -echo "Config-server eSignet pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh deleted file mode 100755 index ecea9f0b0..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID Pre-install -# ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid namespace. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-mosipid" - -echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID Pre-install" -echo "================================================" - -kubectl apply -f - </dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created." -else - echo "esignet-misp-onboarder-key already exists, skipping placeholder." -fi - -echo "Config-server eSignet pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh deleted file mode 100755 index ecea9f0b0..000000000 --- a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID Pre-install -# ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid namespace. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-mosipid" - -echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID Pre-install" -echo "================================================" - -kubectl apply -f - < Date: Tue, 18 Aug 2026 12:58:26 +0530 Subject: [PATCH 058/127] Switch esignet-mock to PKCS12 keystore with a persistent volume (esignet-standalone-2.0.0) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit esignet-mock now uses KEYMANAGER_KEYSTORE_TYPE=PKCS12 instead of SoftHSM/ PKCS11, with a PVC (persistence.enabled, chart-managed) mounted at the chart's default /home/mosip/config/ so the keystore file survives pod restarts. The app generates the PKCS12 keystore itself on first run when it doesn't already exist at KEYMANAGER_PKCS12_FILE_PATH — no init container or preinstall hook needed. Uses a fixed known password ("localtest"), matching the precedent this repo already established for the same throwaway/self-signed keystore use case (mosipid1's now-removed PKCS12 setup) — esignet-mock is a mock/ demo instance, not production key material. esignet-mosipid and esignet-sunbird are untouched and remain on PKCS11/ SoftHSM. Verified via `helm template` against the local esignet chart checkout (PVC created, env vars wired to the right mount) and `helmsman -dry-run -debug` against the DSF (19 apps, correct per-instance keystore values). Signed-off-by: bhumi46 --- .../dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 647a9eaef..4ef4d6f6d 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -132,12 +132,11 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" - extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" - extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" + extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/esignet.pfx" + extraEnvVars.KEYMANAGER_PKCS12_PASSWORD: "localtest" + persistence.enabled: "true" + persistence.pvc_claim_name: "esignet-mock-pkcs12-keystore" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" From 5ab2a07b3f66e45f9751d55890e15b83fff3473b Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 18 Aug 2026 13:04:40 +0530 Subject: [PATCH 059/127] Move esignet-mock's PKCS12 keymanager overrides to extraEnvVarsAdditional extraEnvVars is merged with the chart's own default extraEnvVars map before rendering, so removing the previous explicit PKCS11 overrides just let the chart's PKCS11 defaults resurface for the same keys instead of disappearing. extraEnvVarsAdditional renders after extraEnvVars in the container's env: list, so with Kubernetes' last-wins behavior for duplicate env var names, setting KEYMANAGER_KEYSTORE_TYPE/KEYMANAGER_PKCS12_FILE_PATH/ KEYMANAGER_PKCS12_PASSWORD there correctly overrides the chart's PKCS11 defaults instead of merely coexisting with them. Verified via `helm template` against the local esignet chart checkout: both a PKCS11 (chart default, from extraEnvVars) and PKCS12 (from extraEnvVarsAdditional) KEYMANAGER_KEYSTORE_TYPE entry appear in the rendered container env list, in that order, with PKCS12 taking effect. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 4ef4d6f6d..e46e427be 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -132,9 +132,6 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" - extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/esignet.pfx" - extraEnvVars.KEYMANAGER_PKCS12_PASSWORD: "localtest" persistence.enabled: "true" persistence.pvc_claim_name: "esignet-mock-pkcs12-keystore" extraEnvVars.OIDC_UI_SCHEME: "https" @@ -147,6 +144,12 @@ apps: extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + # Overrides via extraEnvVarsAdditional (rendered after extraEnvVars in the + # container's env: list, so last-wins semantics correctly override the + # chart's own PKCS11 extraEnvVars defaults for this same instance). + extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" + extraEnvVarsAdditional.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/esignet.pfx" + extraEnvVarsAdditional.KEYMANAGER_PKCS12_PASSWORD: "localtest" timeout: 600 priority: -14 hooks: From 7e93a74c174c9c5f13bb311805f56e2793b7af6c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 18 Aug 2026 13:48:27 +0530 Subject: [PATCH 060/127] Move esignet-mosipid/esignet-sunbird keymanager config to extraEnvVarsAdditional Relocates KEYMANAGER_DB_SCHEMA/KEYMANAGER_KEYSTORE_TYPE/KEYMANAGER_PKCS11_* from extraEnvVars to extraEnvVarsAdditional for both instances, using the generic chart-default values (pkcs11-proxy module path/token label, shared esignet-softhsm secret name) as specified, replacing the previous per-instance values (real softhsm module path, "esignet" token label, esignet-softhsm-mosipid/esignet-softhsm-sunbird secrets). Verified via `helmsman -dry-run -debug`: 19 apps, both instances' resolved values match exactly. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index e46e427be..027c8f293 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -214,13 +214,13 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" - extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" - extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" - extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" @@ -305,13 +305,13 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" - extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" - extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" - extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" From 191875a9cb53d7bafd650d35be5d8443e2944773 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 18 Aug 2026 13:57:26 +0530 Subject: [PATCH 061/127] Use per-instance SoftHSM secret for KEYMANAGER_PKCS11_PIN on mosipid/sunbird Keeps the generic pkcs11-proxy module path/token label, but the PIN secret must be the instance-specific one (esignet-softhsm-mosipid, esignet-softhsm-sunbird) since that's where each instance's actual SoftHSM PIN lives - a shared esignet-softhsm secret doesn't exist in those namespaces. Verified via helmsman -dry-run -debug: 19 apps, both instances resolve to their correct per-instance secret name. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 027c8f293..e89861ea2 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -219,7 +219,7 @@ apps: extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -310,7 +310,7 @@ apps: extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" From 2376fb2e9f34301978de637a00ed976ad0085f3e Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 18 Aug 2026 17:26:08 +0530 Subject: [PATCH 062/127] Remove preregistration captcha env var from the shared captcha chart MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mosip/captcha's chart default extraEnvVars only contains MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_PREREGISTRATION, sourced from a mosip-captcha/prereg-captcha-secret-key secret that doesn't exist in this deployment (no preregistration module in the esignet-standalone profiles), causing a config error on the captcha pod. Sets extraEnvVars: "" to empty it out — the chart's extraEnvVars is a raw YAML block string (common.tplvalues.render'd, not a list or map like other charts in this repo), so an empty string is what skips the {{- if .Values.extraEnvVars }} block entirely. esignet/mosipid/sunbird/signup captcha secrets are unaffected — those are wired up separately via kubectl patch in the *-preinstall.sh / captcha-postinstall.sh hooks, not through this chart value. Verified via `helm template` against the actual mosip/captcha v0.1.1 chart (env var gone, everything else byte-identical) and `helmsman -dry-run -debug` against external-dsf.yaml. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone/external-dsf.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index 646442d9a..a84a09971 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -497,6 +497,13 @@ apps: chart: mosip/captcha set: metrics.serviceMonitor.enabled: "false" + # Chart default extraEnvVars only contains MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_PREREGISTRATION, + # sourced from a mosip-captcha/prereg-captcha-secret-key secret that doesn't exist in this + # deployment (no preregistration module here) — empty it out so the chart doesn't try to + # wire up a nonexistent secret. esignet/mosipid/sunbird/signup captcha env vars are added + # separately via kubectl patch in the *-preinstall.sh / captcha-postinstall.sh hooks, not + # through this chart value. + extraEnvVars: "" wait: true timeout: 480 priority: -10 From 38aadb580a1cea7cbbfac6b5b1de9c12123fa9f4 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 12:50:34 +0530 Subject: [PATCH 063/127] Fix PKCS11 token label and add HSM client zip download for mosipid/sunbird KEYMANAGER_PKCS11_TOKEN_LABEL corrected from pkcs11-proxy to mosip-token for esignet-mosipid and esignet-sunbird. Adds hsm_client_zip_url_env, a plain container env var (not a chart value) read directly by esignet-service's docker-entrypoint.sh at startup - if set, it downloads and unzips a PKCS11 client library from the given URL into hsm_local_dir_env before the app starts. The esignet-service Dockerfile only bakes this in via a build-arg with no default, so without setting it at runtime the KEYMANAGER_PKCS11_MODULE_PATH (/usr/local/lib/softhsm/libpkcs11-proxy.so) referenced by these two instances may not actually exist in the container. Note: hsm_local_dir_env defaults to a relative "hsm-client" dir (under work_dir, i.e. /home/mosip/hsm-client) per the Dockerfile, not /usr/local/lib/softhsm - not touched here since it wasn't part of what was asked, but worth checking that the downloaded zip's contents actually land at the configured module path. Verified via helmsman -dry-run -debug: 19 apps, both instances resolve to the correct values. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index e89861ea2..8f6610055 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -217,10 +217,11 @@ apps: extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" @@ -308,10 +309,11 @@ apps: extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" From a1fe88d2b978c9d565b7e3b093c49ecf938b16bb Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 12:54:24 +0530 Subject: [PATCH 064/127] Remove esignet-global configmap ref from esignet-mosipid extraEnvVarsCM[1]: "esignet-global" removed from esignet-mosipid's set block. extraEnvVarsCM[0] (esignet-softhsm-mosipid-share) is untouched. Verified via helmsman -dry-run -debug: 19 apps, esignet-mosipid's extraEnvVarsCM resolves to just the softhsm-share entry. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 8f6610055..e3dcdb27f 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -170,7 +170,6 @@ apps: pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" - extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" From eb76f07ac0885797e93d71e4576df8612e3ffdf4 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 14:08:10 +0530 Subject: [PATCH 065/127] Fix double comma-escaping causing 'key "phone" has no value' on esignet-mosipid Root cause (verified against Helmsman v3.17.1 source, internal/app/release.go getSetValues()): Helmsman unconditionally escapes every literal comma in every set: value via strings.ReplaceAll(v, ",", "\\,") before passing it to `helm --set`, regardless of whether the value already contains a manually-escaped \, sequence. Values in this file that were hand-escaped per Helm's own strvals convention (\, for a literal comma) got double-escaped into \\, by Helmsman, which strvals then parses as "literal backslash followed by an unescaped separator comma" - splitting the value mid-string and producing dangling tokens like the "phone" segment of MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS's postfix values. Fix: remove the manual \, escaping (plain commas), since Helmsman already adds it automatically. \{ and \} escaping is untouched - Helmsman's ReplaceAll only touches commas. None of this was caught by this session's earlier helmsman -dry-run verifications because dry-run against a fake/unreachable kubeconfig fails at namespace creation, before Helmsman ever reaches the getSetValues() call that happens right before invoking `helm upgrade --install`. Verified by replicating Helmsman's exact getSetValues() transform (one --set flag per key, ReplaceAll(",", "\\,") per value) against the real esignet-mock/esignet-mosipid/esignet-sunbird set: blocks with a local helm template call: reproduced the exact "key \"phone\" has no value" failure before the fix, confirmed clean parsing with the correct final values (e.g. LOGIN_ID_OPTIONS renders its Handlebars wrapper and postfix values intact, IDA_OTP_CHANNELS renders as "email,phone") after it. Also re-ran helmsman -dry-run -debug: 19 apps parse correctly. Signed-off-by: bhumi46 --- .../dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index e3dcdb27f..e6c4e21b5 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -235,13 +235,13 @@ apps: extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid" extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid-signup-esqa020" - extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email\,phone' + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email,phone' extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: "600" extraEnvVarsAdditional.MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: "600" extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: "@phone" - extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile''\, ''svg'': ''mobile_icon''\, ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND''\, ''value'': ''+91''\, ''maxLength'': ''''\, ''regex'': ''''\}\,\{''label'': ''KHM''\, ''value'': ''+855''\, ''regex'': ''''\{\{ "\}\}" \}\}\, ''postfix'': ''@phone''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''nrc''\, ''svg'': ''nrc_id_icon''\, ''prefixes'': ''''\, ''postfix'': ''@nrc''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''vid''\, ''svg'': ''vid_icon''\, ''prefixes'': ''''\, ''postfix'': ''''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''email''\, ''svg'': ''email_icon''\, ''prefixes'': ''''\, ''postfix'': ''@email''\, ''maxLength'': ''''\, ''regex'': '''' \{\{ "\}\}" \}\}' + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile'', ''svg'': ''mobile_icon'', ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND'', ''value'': ''+91'', ''maxLength'': '''', ''regex'': ''''\},\{''label'': ''KHM'', ''value'': ''+855'', ''regex'': ''''\{\{ "\}\}" \}\}, ''postfix'': ''@phone'', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''nrc'', ''svg'': ''nrc_id_icon'', ''prefixes'': '''', ''postfix'': ''@nrc'', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''vid'', ''svg'': ''vid_icon'', ''prefixes'': '''', ''postfix'': '''', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''email'', ''svg'': ''email_icon'', ''prefixes'': '''', ''postfix'': ''@email'', ''maxLength'': '''', ''regex'': '''' \{\{ "\}\}" \}\}' extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" @@ -440,7 +440,7 @@ apps: extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.name: "softhsm-mock-identity-system" extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.hsm_local_dir_name: "hsm-client" - extraEnvVars.MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: 'individualId\,password' + extraEnvVars.MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: 'individualId,password' extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" @@ -476,7 +476,7 @@ apps: extraEnvVars.GRANT_TYPE: "authorization_code" extraEnvVars.CLAIMS_LOCALES: "en" extraEnvVars.SCOPE_USER_PROFILE: "openid profile" - extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' mock_relying_party_service.host: "" mock_relying_party_service.mountDir: "" mock_relying_party_service.healthCheckUrl: null @@ -510,7 +510,7 @@ apps: extraEnvVars.GRANT_TYPE: "authorization_code" extraEnvVars.CLAIMS_LOCALES: "en" extraEnvVars.SCOPE_USER_PROFILE: "openid profile" - extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' mock_relying_party_service.host: "" mock_relying_party_service.mountDir: "" mock_relying_party_service.healthCheckUrl: null @@ -544,7 +544,7 @@ apps: extraEnvVars.GRANT_TYPE: "authorization_code" extraEnvVars.CLAIMS_LOCALES: "en" extraEnvVars.SCOPE_USER_PROFILE: "openid profile" - extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' mock_relying_party_service.host: "" mock_relying_party_service.mountDir: "" mock_relying_party_service.healthCheckUrl: null From ed37a879768fa803e998606c20e120b8802ac5aa Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 14:39:31 +0530 Subject: [PATCH 066/127] Fix CreateContainerConfigError on esignet-mock and esignet-mosipid/sunbird Root cause: the mosip/esignet chart's own default extraEnvVars entries reference cluster resources that don't exist in every namespace this profile deploys into, and Kubernetes fails the whole pod if any single env entry references a missing ConfigMap/Secret key - even when a working duplicate (added via our own extraEnvVars/extraEnvVarsAdditional overrides) exists elsewhere in the same env: list. esignet-mock: MOSIP_API_INTERNAL_HOST, MOSIP_ESIGNET_OIDC_UI_HOSTNAME, MOSIP_ESIGNET_HOST, MOSIP_SIGNUP_HOST default to configMapKeyRefs against an "esignet-global" configmap that only exists for the mosipid/sunbird instances (created by their own preinstall hooks) - esignet-mock's hook never creates one. Overridden to plain hostname strings matching domainConfig's already-correct values. esignet-mosipid/esignet-sunbird: KEYMANAGER_PKCS11_PIN defaults to a secretKeyRef against a plain "esignet-softhsm" secret that only exists in the mock namespace. Each instance already had this correctly overridden under extraEnvVarsAdditional, but that doesn't remove the broken chart-default entry under extraEnvVars - both instances now also override it directly under extraEnvVars, pointing at their own esignet-softhsm-mosipid/esignet-softhsm-sunbird secret. Verified via helmsman -dry-run -debug: 19 apps, all three instances' resolved values are correct and consistent with their domainConfig/ extraEnvVarsAdditional counterparts. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index e6c4e21b5..9933b4856 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -105,6 +105,14 @@ apps: domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" domainConfig.OIDC_UI_HOSTNAME: "esignet.${domain_name}" + # esignet-mock has no esignet-global configmap (only the mosipid/sunbird preinstall + # hooks create their own per-namespace esignet-global) - override these chart-default + # extraEnvVars entries that otherwise reference it, or the pod fails to start with + # CreateContainerConfigError (configmap "esignet-global" not found). + extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + extraEnvVars.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "esignet.${domain_name}" + extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" + extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" @@ -210,6 +218,13 @@ apps: extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" + # secret that doesn't exist in this namespace (only esignet-softhsm-mosipid does) - + # the extraEnvVarsAdditional override below doesn't remove this broken chart-default + # entry, and Kubernetes fails the whole pod if any single env entry references a + # missing secret, even with a working duplicate elsewhere in the list. + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" @@ -302,6 +317,13 @@ apps: extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" + # secret that doesn't exist in this namespace (only esignet-softhsm-sunbird does) - + # the extraEnvVarsAdditional override below doesn't remove this broken chart-default + # entry, and Kubernetes fails the whole pod if any single env entry references a + # missing secret, even with a working duplicate elsewhere in the list. + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" From 851817b2ad788d265e7c02163d6ea396e370b6fe Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 16:04:50 +0530 Subject: [PATCH 067/127] Add KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE for esignet-mock Set via extraEnvVarsAdditional alongside the other PKCS12 keymanager overrides for this instance, consistent with the existing convention (renders after extraEnvVars, so it reliably takes effect regardless of chart defaults for the same key). Verified via helmsman -dry-run -debug: 19 apps, value resolves correctly for esignet-mock only. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 9933b4856..0a6515548 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -158,6 +158,7 @@ apps: extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" extraEnvVarsAdditional.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/esignet.pfx" extraEnvVarsAdditional.KEYMANAGER_PKCS12_PASSWORD: "localtest" + extraEnvVarsAdditional.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" timeout: 600 priority: -14 hooks: From e2edddd79b929173d0be519231b954753aa8e43b Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 16:33:44 +0530 Subject: [PATCH 068/127] Rename esignet-mock's PKCS12 keystore file to keystore.p12 Keeps persistence.mountDir at the chart default (/home/mosip/config/) rather than /home/mosip - the latter is the container's WORKDIR where entrypoint.sh, esignet.exe, and data/ are baked in per the Dockerfile (ENTRYPOINT ["/home/mosip/entrypoint.sh"], CMD ["/home/mosip/esignet.exe"]), so mounting the PVC there would hide them and likely crash the container on start. The file still lands on the persistent volume, just renamed from esignet.pfx to keystore.p12. Verified via helmsman -dry-run -debug: 19 apps, value resolves correctly. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 0a6515548..5a0277c9a 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -156,7 +156,7 @@ apps: # container's env: list, so last-wins semantics correctly override the # chart's own PKCS11 extraEnvVars defaults for this same instance). extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" - extraEnvVarsAdditional.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/esignet.pfx" + extraEnvVarsAdditional.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/keystore.p12" extraEnvVarsAdditional.KEYMANAGER_PKCS12_PASSWORD: "localtest" extraEnvVarsAdditional.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" timeout: 600 From 4c54ea268924cb0887393ab0e46d9eca68680eff Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 09:29:37 +0530 Subject: [PATCH 069/127] Fix esignet-mosipid CAPTCHA_SITE_KEY typo (was SITE-KEY) extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY (hyphen) never matched the real MOSIP_ESIGNET_CAPTCHA_SITE_KEY env var read by the chart, so the captcha site key was silently unset for esignet-mosipid. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 5a0277c9a..94e3222e4 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -245,8 +245,8 @@ apps: extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetmosipid" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-mosipid" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-mosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.NAMESPACE: "mosipid" extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid" From 3dd733f5d71216642218d828c40e711a55708bfb Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 09:29:55 +0530 Subject: [PATCH 070/127] Consolidate KEYMANAGER_* overrides into extraEnvVars for mock/mosipid/sunbird Chart-default extraEnvVars.KEYMANAGER_KEYSTORE_TYPE/PKCS11_MODULE_PATH/ PKCS11_TOKEN_LABEL/PKCS11_SLOT_ID/PKCS11_PIN/DB_SCHEMA were being overridden only via extraEnvVarsAdditional, which relies on rendering order to win rather than replacing the chart-default extraEnvVars entries. That left redundant/confusing duplicate env entries in the rendered manifest for all three esignet-standalone-2.0.0 instances. Override these keys directly under extraEnvVars instead so only one entry per key renders. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 54 ++++++++++--------- 1 file changed, 28 insertions(+), 26 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 94e3222e4..c685ba834 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -152,12 +152,20 @@ apps: extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" - # Overrides via extraEnvVarsAdditional (rendered after extraEnvVars in the - # container's env: list, so last-wins semantics correctly override the - # chart's own PKCS11 extraEnvVars defaults for this same instance). - extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" - extraEnvVarsAdditional.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/keystore.p12" - extraEnvVarsAdditional.KEYMANAGER_PKCS12_PASSWORD: "localtest" + # Overridden directly under extraEnvVars (not extraEnvVarsAdditional) so the + # chart's own PKCS11 defaults for these same keys don't also render into the + # env: list - relying on extraEnvVarsAdditional's last-wins ordering left the + # redundant PKCS11 entries (module path, token label, slot id, PIN secretKeyRef) + # coexisting alongside these, which happened to still work here (esignet-softhsm + # secret exists in this namespace) but is fragile and confusing. + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" + extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/keystore.p12" + extraEnvVars.KEYMANAGER_PKCS12_PASSWORD: "localtest" + extraEnvVars.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "" + extraEnvVars.KEYMANAGER_PKCS11_PIN: "" extraEnvVarsAdditional.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" timeout: 600 priority: -14 @@ -221,21 +229,18 @@ apps: extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" # secret that doesn't exist in this namespace (only esignet-softhsm-mosipid does) - - # the extraEnvVarsAdditional override below doesn't remove this broken chart-default - # entry, and Kubernetes fails the whole pod if any single env entry references a - # missing secret, even with a working duplicate elsewhere in the list. + # override directly under extraEnvVars (not extraEnvVarsAdditional) so the chart's + # own defaults for these same keys don't also coexist redundantly in the rendered env. + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" - extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -320,21 +325,18 @@ apps: extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" # secret that doesn't exist in this namespace (only esignet-softhsm-sunbird does) - - # the extraEnvVarsAdditional override below doesn't remove this broken chart-default - # entry, and Kubernetes fails the whole pod if any single env entry references a - # missing secret, even with a working duplicate elsewhere in the list. + # override directly under extraEnvVars (not extraEnvVarsAdditional) so the chart's + # own defaults for these same keys don't also coexist redundantly in the rendered env. + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" - extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" From 1f864ac0df5fd8a58bd852eabc27342d8e6d79f6 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 11:21:06 +0530 Subject: [PATCH 071/127] Fix minio helm upgrade failing with empty auth.rootPassword The MINIO_ROOT_PASSWORD fetch in helmsman_external.yml ran before WireGuard/kubeconfig were set up, so kubectl could never reach the cluster and the value was always empty. Moved the fetch to its own step after cluster access is verified, and wired auth.rootPassword into the minio app's set: block in external-dsf.yaml so the fetched password actually reaches helm upgrade (previously it was fetched but never consumed by the minio release itself). Signed-off-by: bhumi46 --- .github/workflows/helmsman_external.yml | 17 +++++++++++++---- .../dsf/esignet-standalone/external-dsf.yaml | 5 +++++ 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/.github/workflows/helmsman_external.yml b/.github/workflows/helmsman_external.yml index 1700a13e7..fb011f045 100644 --- a/.github/workflows/helmsman_external.yml +++ b/.github/workflows/helmsman_external.yml @@ -224,9 +224,6 @@ jobs: - name: Mask sensitive secrets run: | - MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' 2>/dev/null | base64 -d || true) - if [ -n "$MINIO_ROOT_PASSWORD" ]; then echo "::add-mask::$MINIO_ROOT_PASSWORD"; fi - echo "MINIO_ROOT_PASSWORD=$MINIO_ROOT_PASSWORD" >> $GITHUB_ENV echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.PREREG_CAPTCHA_SITE_KEY }}" @@ -337,8 +334,20 @@ jobs: kubectl get nodes kubectl cluster-info - # Test istioctl functionality + # Test istioctl functionality istioctl version --remote=false + + - name: Fetch and mask minio root password + run: | + # Must run after WireGuard/kubeconfig are up - kubectl needs cluster + # access to look up the existing secret. Fetching this earlier (as + # part of "Mask sensitive secrets", before the tunnel is up) always + # returned empty, which then failed minio's helm upgrade with + # "auth.rootPassword must not be empty". + MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' 2>/dev/null | base64 -d || true) + if [ -n "$MINIO_ROOT_PASSWORD" ]; then echo "::add-mask::$MINIO_ROOT_PASSWORD"; fi + echo "MINIO_ROOT_PASSWORD=$MINIO_ROOT_PASSWORD" >> $GITHUB_ENV + - name: Export keycloak client secrets for esignet-keycloak-init if: contains(matrix.dsf_files, 'esignet-standalone/external-dsf.yaml') run: | diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index a84a09971..1c2d51a8c 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -518,6 +518,11 @@ apps: set: image.repository: "mosipid/minio" image.tag: "2022.2.7-debian-10-r0" + # Required on upgrade - the chart's Bitnami-based validation rejects an + # empty auth.rootPassword once the release already exists. MINIO_ROOT_PASSWORD + # is fetched from the existing "minio" secret by the CI workflow before + # helmsman runs; empty on first install, which the chart auto-generates for. + auth.rootPassword: "${MINIO_ROOT_PASSWORD}" metrics.serviceMonitor.enabled: "true" extraEnvVars[0].name: "MINIO_PROMETHEUS_URL" extraEnvVars[0].value: "http://rancher-monitoring-prometheus.cattle-monitoring-system:9090" From 42baffb807ce5b73a2c726329613c896ba45be08 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 14:42:48 +0530 Subject: [PATCH 072/127] Isolate esignet-standalone-2.0.0 mock/sunbird/mosipid onto develop-go databases Previously these three namespaces silently shared their Postgres database with the retired v1.7.1 esignet-standalone profile (mosip_esignet / mosip_esignet_sunbird / mosip_esignet_mosipid, branch develop) despite comments claiming isolation. Enable the existing but unused/orphaned mosip_esignet_go / mosip_esignet_go_sunbird / mosip_esignet_go_mosipid entries, set their branch to develop-go, and repoint the three esignet-standalone-2.0.0 preinstall hooks' postgres-config patches at these dedicated db names/users so the isolation is actually real. Note: this starts these three namespaces on fresh, empty databases - no data carries over from the previously shared ones. Signed-off-by: bhumi46 --- .../dsf/esignet-standalone/external-dsf.yaml | 25 +++++++++++-------- .../esignet-mosipid-preinstall.sh | 2 +- .../esignet-preinstall.sh | 2 +- .../esignet-sunbird-preinstall.sh | 4 +-- 4 files changed, 18 insertions(+), 15 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index 1c2d51a8c..9b1ec09e4 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -170,17 +170,20 @@ apps: # --------------------------------------------------------------------------- # esignet-standalone-2.0.0 profile databases # --------------------------------------------------------------------------- - # mosip_esignet_go / mosip_esignet_go_sunbird / mosip_mockidentitysystem_go - # are disabled — the Go profile shares the same physical databases as the - # (retired) v1.7.1 profile above (mosip_esignet / mosip_esignet_sunbird / - # mosip_mockidentitysystem) instead of maintaining isolated duplicates. Kept - # with the _go suffix (rather than deleted) so the key stays distinct from - # the v1.7.1 entries above in this flat set: map. - databases.mosip_esignet_go.enabled: "false" + # mosip_esignet_go / mosip_esignet_go_sunbird / mosip_esignet_go_mosipid are + # isolated databases dedicated to the Go profile, separate from the (retired) + # v1.7.1 profile's mosip_esignet / mosip_esignet_sunbird / mosip_esignet_mosipid + # above. Kept with the _go suffix so the key stays distinct from the v1.7.1 + # entries above in this flat set: map. branch: develop-go matches the esignet + # repo branch these three namespaces' images/DB-init scripts are built from. + # The esignet-standalone-2.0.0 preinstall hooks (esignet-preinstall.sh, + # esignet-sunbird-preinstall.sh, esignet-mosipid-preinstall.sh) must point + # postgres-config at these same db names/users. + databases.mosip_esignet_go.enabled: "true" databases.mosip_esignet_go.scriptsDir: "mosip_esignet" databases.mosip_esignet_go.dbName: "mosip_esignet_go" databases.mosip_esignet_go.dbUser: "esignetuser_go" - databases.mosip_esignet_go.branch: "develop" + databases.mosip_esignet_go.branch: "develop-go" databases.mosip_esignet_go.host: "postgres.${domain_name}" databases.mosip_esignet_go.port: ${esignet_db_port} databases.mosip_esignet_go.dml: 1 @@ -193,7 +196,7 @@ apps: databases.mosip_esignet_go_mosipid.scriptsDir: "mosip_esignet" databases.mosip_esignet_go_mosipid.dbName: "mosip_esignet_go_mosipid" databases.mosip_esignet_go_mosipid.dbUser: "esignetuser_go_mosipid" - databases.mosip_esignet_go_mosipid.branch: "develop" + databases.mosip_esignet_go_mosipid.branch: "develop-go" databases.mosip_esignet_go_mosipid.host: "postgres.${domain_name}" databases.mosip_esignet_go_mosipid.port: ${esignet_db_port} databases.mosip_esignet_go_mosipid.dml: 1 @@ -202,11 +205,11 @@ apps: databases.mosip_esignet_go_mosipid.su.user: "postgres" databases.mosip_esignet_go_mosipid.su.secret.name: "postgres-postgresql" databases.mosip_esignet_go_mosipid.su.secret.key: "postgres-password" - databases.mosip_esignet_go_sunbird.enabled: "false" + databases.mosip_esignet_go_sunbird.enabled: "true" databases.mosip_esignet_go_sunbird.scriptsDir: "mosip_esignet" databases.mosip_esignet_go_sunbird.dbName: "mosip_esignet_go_sunbird" databases.mosip_esignet_go_sunbird.dbUser: "esignetuser_go_sunbird" - databases.mosip_esignet_go_sunbird.branch: "develop" + databases.mosip_esignet_go_sunbird.branch: "develop-go" databases.mosip_esignet_go_sunbird.host: "postgres.${domain_name}" databases.mosip_esignet_go_sunbird.port: ${esignet_db_port} databases.mosip_esignet_go_sunbird.dml: 1 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh index 92b506c9e..df3e0c89d 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh @@ -35,7 +35,7 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ # Override postgres-config with MOSIPID-specific DB values (2.0.0: isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid","database-username":"esignetuser_mosipid"}}' + -p '{"data":{"database-name":"mosip_esignet_go_mosipid","database-username":"esignetuser_go_mosipid"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index 72f6052ba..90505c084 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -41,7 +41,7 @@ $COPY_UTIL configmap postgres-config "$POSTGRES_NS" "$ESIGNET_NS" # Override postgres-config with 2.0.0-specific DB values (isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet","database-username":"esignetuser"}}' + -p '{"data":{"database-name":"mosip_esignet_go","database-username":"esignetuser_go"}}' echo "Copying redis-config configmap from $REDIS_NS" $COPY_UTIL configmap redis-config "$REDIS_NS" "$ESIGNET_NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh index a25dd63d6..f2b29752c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh @@ -31,9 +31,9 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - -# Override postgres-config with Sunbird-specific DB values +# Override postgres-config with Sunbird-specific DB values (2.0.0: isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_sunbird","database-username":"esignetuser_sunbird"}}' + -p '{"data":{"database-name":"mosip_esignet_go_sunbird","database-username":"esignetuser_go_sunbird"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then From f8d4c96af1255d015860b5cadba8315e3699b35f Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 14:47:58 +0530 Subject: [PATCH 073/127] Switch esignet image to mosipdev/esignet for esignet-standalone-2.0.0 Changed image.repository from mosipqa/esignet to mosipdev/esignet for esignet-mock, esignet-mosipid, and esignet-sunbird (tag stays develop-go). Also removed the redundant extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID override for mosipid/sunbird - it duplicated the chart's own default (0), which already renders correctly without an explicit override. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index c685ba834..ede9eafe3 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -85,7 +85,7 @@ apps: version: 2.0.0-develop chart: mosip/esignet set: - image.repository: "mosipqa/esignet" + image.repository: "mosipdev/esignet" image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" @@ -179,7 +179,7 @@ apps: version: 2.0.0-develop chart: mosip/esignet set: - image.repository: "mosipqa/esignet" + image.repository: "mosipdev/esignet" image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" @@ -235,7 +235,6 @@ apps: extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" @@ -279,7 +278,7 @@ apps: version: 2.0.0-develop chart: mosip/esignet set: - image.repository: "mosipqa/esignet" + image.repository: "mosipdev/esignet" image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" @@ -331,7 +330,6 @@ apps: extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" From a512a69442c0046af07bfb23f750f485f58c63c6 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 15:50:24 +0530 Subject: [PATCH 074/127] Fix AUTHN_PROVIDER key name and add per-instance NAMESPACE for mock/mosipid/sunbird extraEnvVars.AUTHN_PROVIDER wasn't the env var the chart/app actually reads (chart default key is MOSIP_ESIGNET_AUTHN_PROVIDER: mosip) - our override under the wrong name never took effect, so all three instances silently ran with the chart default 'mosip' regardless of what we set. Renamed to MOSIP_ESIGNET_AUTHN_PROVIDER with correct per-instance values (mock/mosip/ sunbird), and added NAMESPACE (mock/mosipid/sunbird respectively) which previously only existed for mosipid, and only via extraEnvVarsAdditional. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index ede9eafe3..ac8273bfd 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -138,7 +138,8 @@ apps: extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" - extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mock" + extraEnvVars.NAMESPACE: "mock" extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" persistence.enabled: "true" persistence.pvc_claim_name: "esignet-mock-pkcs12-keystore" @@ -239,7 +240,8 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" - extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mosip" + extraEnvVars.NAMESPACE: "mosipid" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -251,7 +253,6 @@ apps: extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetmosipid" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-mosipid" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" - extraEnvVarsAdditional.NAMESPACE: "mosipid" extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid" extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid-signup-esqa020" @@ -334,7 +335,8 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" - extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "sunbird" + extraEnvVars.NAMESPACE: "sunbird" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" From 5f134db24182625335d4a5c3192fa162f46d1f2e Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 15:52:27 +0530 Subject: [PATCH 075/127] Add MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER and CAPTCHA_VALIDATOR_URL for esignet-mock/mosipid/sunbird Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index ac8273bfd..bad7e8b5a 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -118,6 +118,8 @@ apps: extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignet" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" @@ -242,6 +244,8 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mosip" extraEnvVars.NAMESPACE: "mosipid" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -337,6 +341,8 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "sunbird" extraEnvVars.NAMESPACE: "sunbird" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" From 6a4a236c3008776704109213ab400b4aa7eda880 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 16:12:30 +0530 Subject: [PATCH 076/127] Fix duplicate MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST env entries Both domainConfig and the chart's own extraEnvVars defaults set these same three key names, rendering as two separate entries with the same 'name' in the container's env: list. Kubernetes' strategic-merge-patch can't compute a consistent $setElementOrder when the merge key isn't unique, causing 'Diffing release... failed' errors on upgrade for esignet-mosipid and esignet-sunbird. esignet-mock already had correct extraEnvVars overrides for these keys (needed separately to avoid a missing esignet-global configmap crash) - just removed the redundant domainConfig copies there. esignet-mosipid/esignet-sunbird only had domainConfig entries; moved them into extraEnvVars unchanged. This also matters for correctness, not just dedup: the chart-default extraEnvVars values (sourced from the esignet-global configmap) are missing the https:// scheme, and for mosipid specifically point at the wrong domain (domain_name instead of mosipid_domain_name) - letting the chart default become the sole source would have silently broken the mosip-identity-plugin's actual endpoints. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index bad7e8b5a..3f53fd70c 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -95,11 +95,8 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -191,11 +188,8 @@ apps: pluginUrlEnv: "" extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -210,6 +204,13 @@ apps: domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" domainConfig.OIDC_UI_HOSTNAME: "esignet-mosipid.${domain_name}" + # Moved from domainConfig to extraEnvVars (same key names as the chart's own + # extraEnvVars defaults) to avoid two same-named entries in the rendered env: list, + # which breaks Kubernetes' strategic-merge-patch $setElementOrder computation on + # upgrade. Values unchanged. + extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" + extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" @@ -293,11 +294,8 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-sunbird-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -306,6 +304,13 @@ apps: domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" domainConfig.OIDC_UI_HOSTNAME: "esignet-sunbird.${domain_name}" + # Moved from domainConfig to extraEnvVars (same key names as the chart's own + # extraEnvVars defaults) to avoid two same-named entries in the rendered env: list, + # which breaks Kubernetes' strategic-merge-patch $setElementOrder computation on + # upgrade. Values unchanged. + extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" + extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetsunbird" From 3c70d7b2ceb303da63e26e026408d5693966732c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 16:36:20 +0530 Subject: [PATCH 077/127] Remove duplicate MOSIP_ESIGNET_CAPTCHA_SITE_KEY for esignet-mock Was set under both extraEnvVars and extraEnvVarsAdditional with identical values, rendering as two same-named entries in the env: list - same duplicate-key class as the recent MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/ MOSIP_API_INTERNAL_HOST fix, confirmed via the live deployed pod spec. Kept the extraEnvVars entry, removed the redundant extraEnvVarsAdditional copy. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 3f53fd70c..29c0ccf80 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -149,8 +149,6 @@ apps: extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" # Overridden directly under extraEnvVars (not extraEnvVarsAdditional) so the # chart's own PKCS11 defaults for these same keys don't also render into the From a34b34dc9a26978a34fa13367eb7a53f4d5b93df Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:04:11 +0530 Subject: [PATCH 078/127] Remove duplicate KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE for esignet-mock Same duplicate-key class as the recent env var fixes - set under both extraEnvVars and extraEnvVarsAdditional with identical values. Kept the extraEnvVars entry, removed the redundant extraEnvVarsAdditional copy. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 29c0ccf80..c2a0f5718 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -164,7 +164,6 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "" extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "" extraEnvVars.KEYMANAGER_PKCS11_PIN: "" - extraEnvVarsAdditional.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" timeout: 600 priority: -14 hooks: From acf6b09d8d570c3b98734fe83187d7fdc26a5c0c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:18:43 +0530 Subject: [PATCH 079/127] Null out chart-default MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST instead of string-overriding for mosipid/sunbird The previous fix overrode these chart-default extraEnvVars entries (tables, via valueFrom.configMapKeyRef) with plain string values at the same key. That still eliminated the duplicate-name issue, but Helm's coalesce logic emits a 'cannot overwrite table with non table' warning for every such override - confirmed via a real Helm 3.17.1 binary (matching what CI installs) that this warning is harmless on its own (the override still applies correctly), but it's very likely eating into Helmsman's truncated error output and masking whatever the actual 'Diffing release... failed with exit code 2' error is for esignet-mosipid/esignet-sunbird (esignet-mock has the same warning pattern today without failing, ruling out the warning itself as the cause). Switched to nulling the chart-default keys entirely (null, quoted - a bare YAML null unmarshals to an empty string via Helmsman's sigs.k8s.io/yaml parsing, not the literal text Helm needs) and moved the actual values back to domainConfig, which no longer conflicts since extraEnvVars no longer supplies these keys at all. Verified against a real Helm 3.17.1 binary: zero warnings, single correct entry per key. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 44 +++++++++++++------ 1 file changed, 30 insertions(+), 14 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index c2a0f5718..fb80cec4e 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -201,13 +201,21 @@ apps: domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" domainConfig.OIDC_UI_HOSTNAME: "esignet-mosipid.${domain_name}" - # Moved from domainConfig to extraEnvVars (same key names as the chart's own - # extraEnvVars defaults) to avoid two same-named entries in the rendered env: list, - # which breaks Kubernetes' strategic-merge-patch $setElementOrder computation on - # upgrade. Values unchanged. - extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" - extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" - extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST + # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override + # at the same key produces a "cannot overwrite table with non table" coalesce warning + # (harmless on its own, but noisy) and still leaves domainConfig's own same-named entry + # as a genuinely separate list item - so null the chart-default keys out entirely + # instead, letting domainConfig (above) be the sole source, matching the pattern used + # for KEYMANAGER_PKCS11_* elsewhere in this file. "null" (quoted) is required: Helmsman's + # YAML parsing turns a bare `null` into an empty string, not the literal text Helm needs + # to delete a key. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" @@ -301,13 +309,21 @@ apps: domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" domainConfig.OIDC_UI_HOSTNAME: "esignet-sunbird.${domain_name}" - # Moved from domainConfig to extraEnvVars (same key names as the chart's own - # extraEnvVars defaults) to avoid two same-named entries in the rendered env: list, - # which breaks Kubernetes' strategic-merge-patch $setElementOrder computation on - # upgrade. Values unchanged. - extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" - extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" - extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST + # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override + # at the same key produces a "cannot overwrite table with non table" coalesce warning + # (harmless on its own, but noisy) and still leaves domainConfig's own same-named entry + # as a genuinely separate list item - so null the chart-default keys out entirely + # instead, letting domainConfig (above) be the sole source, matching the pattern used + # for KEYMANAGER_PKCS11_* elsewhere in this file. "null" (quoted) is required: Helmsman's + # YAML parsing turns a bare `null` into an empty string, not the literal text Helm needs + # to delete a key. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetsunbird" From 6113daadac4f2934cf4616e4b4652396dc8f7316 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:21:26 +0530 Subject: [PATCH 080/127] Eliminate coalesce warnings for esignet-mock's MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST/MOSIP_ESIGNET_OIDC_UI_HOSTNAME/KEYMANAGER_PKCS11_PIN Same fix as the recent mosipid/sunbird change, applied to mock for consistency. These five chart-default extraEnvVars entries are all tables (valueFrom.configMapKeyRef or secretKeyRef), and mock's plain-value overrides at the same keys triggered 'cannot overwrite table with non table' coalesce warnings - confirmed harmless on their own via a real Helm 3.17.1 binary, but still worth removing since verbose warnings risk masking real errors in Helmsman's truncated CI output. MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST: nulled under extraEnvVars, values moved to domainConfig (safe for mock specifically - no esignet-global configmap reference survives since the chart-default key is fully deleted, not just given a literal value). MOSIP_ESIGNET_OIDC_UI_HOSTNAME: nulled under extraEnvVars, value moved to extraEnvVarsAdditional (no domainConfig equivalent key exists for this one). KEYMANAGER_PKCS11_PIN: changed from an empty-string override to null - same functional result (PKCS11 unused, PKCS12 is the active keystore type) but as a real deletion instead of a type-conflicting empty string. Verified against a real Helm 3.17.1 binary with mock's full 90-key --set list: exit 0, zero warnings, single correct entry per key. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 31 ++++++++++++++----- 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index fb80cec4e..5c9002ffa 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -102,14 +102,26 @@ apps: domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" domainConfig.OIDC_UI_HOSTNAME: "esignet.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" # esignet-mock has no esignet-global configmap (only the mosipid/sunbird preinstall - # hooks create their own per-namespace esignet-global) - override these chart-default - # extraEnvVars entries that otherwise reference it, or the pod fails to start with - # CreateContainerConfigError (configmap "esignet-global" not found). - extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" - extraEnvVars.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "esignet.${domain_name}" - extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" - extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" + # hooks create their own per-namespace esignet-global) - these chart-default extraEnvVars + # entries are tables (valueFrom.configMapKeyRef against esignet-global), so a plain + # string override at the same key produces a "cannot overwrite table with non table" + # coalesce warning (harmless on its own, but risks masking real errors in Helmsman's + # truncated output) and would still fail with CreateContainerConfigError if left as the + # chart default. Null them out entirely instead - MOSIP_API_INTERNAL_HOST/MOSIP_ESIGNET_HOST/ + # MOSIP_SIGNUP_HOST now come from domainConfig (above); MOSIP_ESIGNET_OIDC_UI_HOSTNAME has + # no domainConfig equivalent key so it's set via extraEnvVarsAdditional instead (renders + # after extraEnvVars, no chart-default table to conflict with). "null" (quoted) is + # required: Helmsman's YAML parsing turns a bare `null` into an empty string, not the + # literal text Helm needs to delete a key. + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" + extraEnvVars.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "null" + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVarsAdditional.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "esignet.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" @@ -163,7 +175,10 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "" extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "" - extraEnvVars.KEYMANAGER_PKCS11_PIN: "" + # KEYMANAGER_PKCS11_PIN's chart default is a table (valueFrom.secretKeyRef), unlike the + # three plain-string defaults above - an empty-string override here still triggers the + # coalesce "cannot overwrite table with non table" warning, so null it out instead. + extraEnvVars.KEYMANAGER_PKCS11_PIN: "null" timeout: 600 priority: -14 hooks: From e9e077cfcc7fc225edf8cf47cc802dfc0411b03d Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:26:12 +0530 Subject: [PATCH 081/127] Fix duplicate/crash-risk MOSIP_ESIGNET_HOST for mock-identity-system Same class of bug as the recent esignet-mock/mosipid/sunbird fixes, found while auditing mock-identity-system, mock-relying-party-service/-ui, and oidc-ui for similar issues. domainConfig.MOSIP_ESIGNET_HOST was set, but the chart-default extraEnvVars.MOSIP_ESIGNET_HOST (a table referencing the esignet-global configmap, which doesn't exist in the esignet-mock namespace) was never nulled - producing both a duplicate-named env entry and a CreateContainerConfigError crash risk. Verified via helm template: single entry, correct value, zero warnings. mock-relying-party-service/-ui and oidc-ui were also audited - their chart defaults for extraEnvVars/domainConfig are empty or unused by this DSF, so no equivalent issue exists there. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 5c9002ffa..74ae39acd 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -491,6 +491,12 @@ apps: domainConfig.installation-domain: "${domain_name}" domainConfig.MOSIP_MOCK_IDA_IDENTITY_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/email-signup-schema-testing.json" domainConfig.MOSIP_MOCK_UI_SPEC_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/ui_spec_reset_password_phone.json" + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST is a table (valueFrom.configMapKeyRef + # against esignet-global), which doesn't exist in the esignet-mock namespace - left + # unset it would both crash with CreateContainerConfigError and duplicate the + # domainConfig.MOSIP_ESIGNET_HOST entry above in the rendered env: list. Null it out + # so domainConfig is the sole source, same pattern as the esignet chart apps. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "mockid-postgres-config" extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "mockid-postgres-config" From dcf119e57baa64dadf613740a7e99f55477f855b Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:49:17 +0530 Subject: [PATCH 082/127] Null out KEYMANAGER_PKCS11_SLOT_ID for esignet-mosipid/esignet-sunbird Previously left unset (chart default '0' rendered implicitly). Now explicitly deleted so it doesn't render at all, matching the pattern used for the other KEYMANAGER_* keys. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 74ae39acd..1529f23fa 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -259,6 +259,7 @@ apps: extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "null" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" @@ -368,6 +369,7 @@ apps: extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "null" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" From 5cdfd1961f503764a514402ee1c5ca00d2fcde70 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:59:24 +0530 Subject: [PATCH 083/127] Set placeholder value for esignet-mosipid's MOSIP_ESIGNET_MISP_KEY The esignet-misp-onboarder-key secret only ever holds an empty value, since the onboarder app that would populate it with a real MISP license key is disabled (and has unrelated ordering/namespace-targeting issues of its own). An empty MISP key makes the Go esignet service Fatal on startup during plugin provider init, blocking esignet-mosipid entirely. Set a literal placeholder value directly instead, to be replaced with the real MISP license key once available. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 1529f23fa..2927baca0 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -292,8 +292,12 @@ apps: extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" - extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" - extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" + # Placeholder - esignet-misp-onboarder-key only ever holds an empty value (the + # onboarder app that would populate it with a real MISP license key is disabled), + # and an empty MISP key makes the Go esignet service Fatal on startup during plugin + # provider init. Direct value until a real MISP license key is available; replace + # with the actual key. + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY: "placeholder-misp-key" timeout: 600 priority: -14 hooks: From fed50555a1c31fae638ff366abd62f01f01610e2 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 19:08:40 +0530 Subject: [PATCH 084/127] Revert MOSIP_ESIGNET_MISP_KEY placeholder, restore secretKeyRef The secretKeyRef wiring itself is correct and was already there. The reason it wasn't reflecting on the live esignet-mosipid pod is almost certainly the value/valueFrom merge-patch conflict from before (commit acf6b09d) blocking upgrades entirely for that release, not a problem with this specific config. Once the live Deployment is deleted and recreated (as discussed), it should pick up correctly. The secret's value itself is still empty pending either the onboarder being properly wired for mosipid or a real MISP license key being supplied. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 2927baca0..1529f23fa 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -292,12 +292,8 @@ apps: extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" - # Placeholder - esignet-misp-onboarder-key only ever holds an empty value (the - # onboarder app that would populate it with a real MISP license key is disabled), - # and an empty MISP key makes the Go esignet service Fatal on startup during plugin - # provider init. Direct value until a real MISP license key is available; replace - # with the actual key. - extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY: "placeholder-misp-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" timeout: 600 priority: -14 hooks: From 1a48af97bf58b104b064b0add24788d11ba166fc Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 26 Aug 2026 14:57:32 +0530 Subject: [PATCH 085/127] Remove KEYMANAGER_PKCS11_SLOT_ID override entirely for mock/mosipid/sunbird The mosip/esignet chart no longer defines this key in its default extraEnvVars at all (confirmed via helm show values against 2.0.0-develop), so there's nothing left to override or null out - deleted the lines entirely rather than leaving a null/empty stub. Verified via helm template: zero occurrences across all three instances. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 1529f23fa..2f21327d9 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -174,7 +174,6 @@ apps: extraEnvVars.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "" # KEYMANAGER_PKCS11_PIN's chart default is a table (valueFrom.secretKeyRef), unlike the # three plain-string defaults above - an empty-string override here still triggers the # coalesce "cannot overwrite table with non table" warning, so null it out instead. @@ -259,7 +258,6 @@ apps: extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "null" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" @@ -369,7 +367,6 @@ apps: extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "null" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" From f4dc5e31ce9dd6b5f0dd689240e05de9f9424a29 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 26 Aug 2026 15:06:13 +0530 Subject: [PATCH 086/127] Add MOSIP_ESIGNET_BASE_URL for esignet-mock/mosipid/sunbird New key, not a chart default for either mosip/esignet - added via domainConfig matching the pattern used for MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST, with value https:///v1/esignet per instance. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 2f21327d9..2b4aa94b4 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -105,6 +105,7 @@ apps: domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" domainConfig.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" + domainConfig.MOSIP_ESIGNET_BASE_URL: "https://esignet.${domain_name}/v1/esignet" # esignet-mock has no esignet-global configmap (only the mosipid/sunbird preinstall # hooks create their own per-namespace esignet-global) - these chart-default extraEnvVars # entries are tables (valueFrom.configMapKeyRef against esignet-global), so a plain @@ -217,6 +218,7 @@ apps: domainConfig.OIDC_UI_HOSTNAME: "esignet-mosipid.${domain_name}" domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_BASE_URL: "https://esignet-mosipid.${domain_name}/v1/esignet" domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override @@ -325,6 +327,7 @@ apps: domainConfig.OIDC_UI_HOSTNAME: "esignet-sunbird.${domain_name}" domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" domainConfig.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" + domainConfig.MOSIP_ESIGNET_BASE_URL: "https://esignet-sunbird.${domain_name}/v1/esignet" domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override From 6e632a81d2966243697ab569b712d91291ec7909 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 27 Aug 2026 15:14:54 +0530 Subject: [PATCH 087/127] Generate a random placeholder for esignet-misp-onboarder-key instead of empty An empty MOSIP_ESIGNET_MISP_KEY makes the Go esignet service Fatal on startup during plugin provider init. Generate a random value via openssl rand instead of an empty string, only on first creation (create-if-missing) so it stays stable across redeploys rather than rotating pointlessly. Signed-off-by: bhumi46 --- .../esignet-mosipid-preinstall.sh | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh index df3e0c89d..2496cb6a8 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh @@ -37,11 +37,16 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ -p '{"data":{"database-name":"mosip_esignet_go_mosipid","database-username":"esignetuser_go_mosipid"}}' -# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. +# Create esignet-misp-onboarder-key with a random placeholder value — real value written +# by MISP onboarder if/when that's wired up. An empty value makes the Go esignet service +# Fatal on startup during plugin provider init, so this can't be left blank. Only generated +# once (create-if-missing, not overwritten on every run) so the value stays stable across +# redeploys - regenerating it on every run would be pointless churn since nothing else reads +# or depends on this specific value being consistent. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" + --from-literal=mosip-esignet-misp-key="$(openssl rand -hex 16)" + echo "esignet-misp-onboarder-key (random placeholder) created in $ESIGNET_NS" fi echo "Creating esignet-captcha-mosipid secret in $CAPTCHA_NS namespace" From fbc7de4d7a5c7b6b13370256d739b9af01190da2 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 3 Sep 2026 13:19:08 +0530 Subject: [PATCH 088/127] Update esignet-misp-onboarder to the properties-driven partner-onboarder values model mosip-onboarding@c801268f replaced hardcoded business values (partner name, org name, policy names, PMS credentials, etc.) with a properties-driven model, gated on onboarding.propertiesOverride.. The old onboarding.variables.mosipid flag no longer applies to the esignet module under this model. Added onboarding.propertiesOverride.esignet.* matching the reference partner-onboarder/values.yaml in mosip/esignet@release-2.0.x, with EXTERNAL_URL adapted to esignet-mosipid's own domain instead of the generic sandbox example. PARTNER_MANAGER_USERNAME/PASSWORD are still placeholder values from the reference, pending real Keycloak credentials for this onboarding job. Verified via helm template against the actual 0.0.1-develop chart: clean render, properties correctly populated. App remains disabled - this only modernizes its config structure to match the current chart version, doesn't change enablement or the namespace-targeting issues discussed separately. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 2b4aa94b4..12c4c18d9 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -763,7 +763,21 @@ apps: onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.push_reports_to_s3: "true" - onboarding.variables.mosipid: "false" + # Properties-driven model (replaces the old onboarding.variables.mosipid flag and + # inline-hardcoded business values, per mosip-onboarding@c801268f). Values match + # the reference partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the + # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to + # this instance. PARTNER_MANAGER_USERNAME/PASSWORD are placeholders pending real + # Keycloak credentials for this onboarding job. + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignet" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignet" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignet" + onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" + onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" + onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusername" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpassword" + onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host" extraEnvVarsSecret[0]: "keycloak" From ce8ba449144f4ea50c91e5b37c07a4b823f1a9b9 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 3 Sep 2026 13:20:58 +0530 Subject: [PATCH 089/127] Keep onboarding.variables.mosipid for esignet-misp-onboarder Restored after removing it in the previous properties-driven model update - it stays alongside the new propertiesOverride.esignet.* block. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 12c4c18d9..bb45b406d 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -763,9 +763,10 @@ apps: onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.push_reports_to_s3: "true" - # Properties-driven model (replaces the old onboarding.variables.mosipid flag and - # inline-hardcoded business values, per mosip-onboarding@c801268f). Values match - # the reference partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the + onboarding.variables.mosipid: "false" + # Properties-driven model for inline-hardcoded business values, per + # mosip-onboarding@c801268f. Values match the reference + # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to # this instance. PARTNER_MANAGER_USERNAME/PASSWORD are placeholders pending real # Keycloak credentials for this onboarding job. From f11474d40dee513899e1c3ad19525d6d79adf2a1 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 3 Sep 2026 13:27:20 +0530 Subject: [PATCH 090/127] Use docker.io/mosipdev/partner-onboarder:develop for all onboarding apps Applies to both esignet-misp-onboarder (disabled) and esignet-mock-rp-onboarder (enabled/live) - the latter previously used mosipid/partner-onboarder:1.3.0-beta.1. Verified via helm template: both resolve to docker.io/mosipdev/partner-onboarder:develop, clean render, no warnings. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index bb45b406d..92a1dfc8c 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -754,6 +754,9 @@ apps: version: 0.0.1-develop chart: mosip/partner-onboarder set: + image.registry: "docker.io" + image.repository: "mosipdev/partner-onboarder" + image.tag: "develop" onboarding.modules[0].name: "esignet" onboarding.modules[0].enabled: "true" onboarding.configmaps.s3.s3-host: "http://minio.minio:9000" @@ -808,8 +811,9 @@ apps: version: 0.0.1-develop chart: mosip/partner-onboarder set: - image.repository: "mosipid/partner-onboarder" - image.tag: "1.3.0-beta.1" + image.registry: "docker.io" + image.repository: "mosipdev/partner-onboarder" + image.tag: "develop" onboarding.modules[0].name: "mock-rp-oidc" onboarding.modules[0].enabled: "true" onboarding.configmaps.s3.s3-host: "http://minio.minio:9000" From caacc32e70c9f0dd86c9e79a88c8ccb864d5f638 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 4 Sep 2026 11:36:44 +0530 Subject: [PATCH 091/127] Pin esignet-mock/mosipid/sunbird to chart version 2.0.0-beta.1 Changed from 2.0.0-develop. Note: confirmed this version has the same broken list-format extraEnvVars/extraEnvVarsAdditional as 2.0.0-develop (built from release-2.0.x-beta.1, which doesn't include the develop-go map-format conversion) - the CreateContainerConfigError/YAML-parse deployment failures will persist until that's addressed separately. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 92a1dfc8c..c85f60131 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -82,7 +82,7 @@ apps: esignet-mock: namespace: esignet-mock enabled: true - version: 2.0.0-develop + version: 2.0.0-beta.1 chart: mosip/esignet set: image.repository: "mosipdev/esignet" @@ -188,7 +188,7 @@ apps: esignet-mosipid: namespace: esignet-mosipid enabled: true - version: 2.0.0-develop + version: 2.0.0-beta.1 chart: mosip/esignet set: image.repository: "mosipdev/esignet" @@ -302,7 +302,7 @@ apps: esignet-sunbird: namespace: esignet-sunbird enabled: true - version: 2.0.0-develop + version: 2.0.0-beta.1 chart: mosip/esignet set: image.repository: "mosipdev/esignet" From b06f0d3a3d08838f1cc1668d50f8a919696ab78f Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 4 Sep 2026 12:51:41 +0530 Subject: [PATCH 092/127] Revert esignet-mock/mosipid/sunbird chart version back to 2.0.0-develop 2.0.0-develop was republished correctly on 2026-09-04 (matching develop-go's map-format extraEnvVars/extraEnvVarsAdditional and range-based deployment.yaml template) - verified via a fresh helm template render, clean exit, no warnings. 2.0.0-beta.1 (the temporary pin) remains on the old broken chart structure and was never fixed, so reverting is strictly better now. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index c85f60131..92a1dfc8c 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -82,7 +82,7 @@ apps: esignet-mock: namespace: esignet-mock enabled: true - version: 2.0.0-beta.1 + version: 2.0.0-develop chart: mosip/esignet set: image.repository: "mosipdev/esignet" @@ -188,7 +188,7 @@ apps: esignet-mosipid: namespace: esignet-mosipid enabled: true - version: 2.0.0-beta.1 + version: 2.0.0-develop chart: mosip/esignet set: image.repository: "mosipdev/esignet" @@ -302,7 +302,7 @@ apps: esignet-sunbird: namespace: esignet-sunbird enabled: true - version: 2.0.0-beta.1 + version: 2.0.0-develop chart: mosip/esignet set: image.repository: "mosipdev/esignet" From ba7512cbdc008628e3aba0d3aa224eea4ff66ea6 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 4 Sep 2026 13:49:17 +0530 Subject: [PATCH 093/127] Bump mock-identity-system/mock-relying-party-service/mock-relying-party-ui chart versions to 0.14.0-develop Applies to all 7 instances (mock-identity-system, and the mock/mosipid/sunbird variants of mock-relying-party-service and mock-relying-party-ui) - was 0.0.1-develop. Verified via helm template against the actual 0.14.0-develop charts for all three: clean exit, no warnings. Signed-off-by: bhumi46 --- .../dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 92a1dfc8c..9f5e6c29a 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -475,7 +475,7 @@ apps: mock-identity-system: namespace: esignet-mock enabled: true - version: 0.0.1-develop + version: 0.14.0-develop chart: mosip/mock-identity-system set: image.repository: "mosipqa/mock-identity-system" @@ -530,7 +530,7 @@ apps: mock-relying-party-service: namespace: esignet-mock enabled: true - version: 0.0.1-develop + version: 0.14.0-develop chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" @@ -564,7 +564,7 @@ apps: mock-relying-party-service-mosipid: namespace: esignet-mosipid enabled: true - version: 0.0.1-develop + version: 0.14.0-develop chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" @@ -598,7 +598,7 @@ apps: mock-relying-party-service-sunbird: namespace: esignet-sunbird enabled: true - version: 0.0.1-develop + version: 0.14.0-develop chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" @@ -632,7 +632,7 @@ apps: mock-relying-party-ui: namespace: esignet-mock enabled: true - version: 0.0.1-develop + version: 0.14.0-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" @@ -668,7 +668,7 @@ apps: mock-relying-party-ui-mosipid: namespace: esignet-mosipid enabled: true - version: 0.0.1-develop + version: 0.14.0-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" @@ -704,7 +704,7 @@ apps: mock-relying-party-ui-sunbird: namespace: esignet-sunbird enabled: true - version: 0.0.1-develop + version: 0.14.0-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" From 3fa82b378cba5b6a22a9aae2b0b82a41a2e9d492 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 4 Sep 2026 17:15:26 +0530 Subject: [PATCH 094/127] Add MOSIP_ESIGNET_MOCK_DOMAIN_URL for esignet-mock Points at mock-identity-system.esignet-mock, needed since mock-identity-system is deployed in esignet-mock rather than the chart's default mockid namespace. Matches issue mosip/esignet#2288 item 8. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 9f5e6c29a..a23f0e771 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -151,6 +151,7 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mock" + extraEnvVars.MOSIP_ESIGNET_MOCK_DOMAIN_URL: "http://mock-identity-system.esignet-mock" extraEnvVars.NAMESPACE: "mock" extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" persistence.enabled: "true" From d2a485a64a1089c9613cf2aae9af70cc5ca200ca Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 4 Sep 2026 18:05:31 +0530 Subject: [PATCH 095/127] Update image tags for oidc-ui/mock-identity-system/mock-relying-party-service/mock-relying-party-ui in 2.0.0 profile oidc-ui (mock/mosipid/sunbird): develop-go -> 2.0.x mock-identity-system: develop -> 0.14.x mock-relying-party-service (mock/mosipid/sunbird): develop-go -> 0.14.x mock-relying-party-ui (mock/mosipid/sunbird): develop-go -> 0.14.x Repositories already correctly pointed at mosipqa/*, only tags changed. Verified each tag exists on Docker Hub and renders correctly via helm template against the actual charts. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index a23f0e771..04e828ea2 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -409,7 +409,7 @@ apps: chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" - image.tag: "develop-go" + image.tag: "2.0.x" istio.hosts[0]: "esignet.${domain_name}" oidc_ui.oidc_service_host: "esignet-mock.esignet-mock" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mock.esignet-mock/v1/esignet" @@ -427,7 +427,7 @@ apps: chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" - image.tag: "develop-go" + image.tag: "2.0.x" istio.hosts[0]: "esignet-mosipid.${domain_name}" oidc_ui.oidc_service_host: "esignet-mosipid.esignet-mosipid" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" @@ -444,7 +444,7 @@ apps: chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" - image.tag: "develop-go" + image.tag: "2.0.x" istio.hosts[0]: "esignet-sunbird.${domain_name}" oidc_ui.oidc_service_host: "esignet-sunbird.esignet-sunbird" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-sunbird.esignet-sunbird/v1/esignet" @@ -480,7 +480,7 @@ apps: chart: mosip/mock-identity-system set: image.repository: "mosipqa/mock-identity-system" - image.tag: "develop" + image.tag: "0.14.x" enable_insecure: "false" extraEnvVarsCM[0]: "softhsm-mock-identity-system-share" domainConfig.MOSIP_ESIGNET_HOST: "esignet.${domain_name}" @@ -535,7 +535,7 @@ apps: chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" - image.tag: "develop-go" + image.tag: "0.14.x" mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet.${domain_name}/v1/esignet" mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet.${domain_name}" mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet.${domain_name}/v1/esignet/oauth2/par" @@ -569,7 +569,7 @@ apps: chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" - image.tag: "develop-go" + image.tag: "0.14.x" mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-mosipid.${domain_name}/v1/esignet" mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid.${domain_name}" mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-mosipid.${domain_name}/v1/esignet/oauth2/par" @@ -603,7 +603,7 @@ apps: chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" - image.tag: "develop-go" + image.tag: "0.14.x" mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-sunbird.${domain_name}/v1/esignet" mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-sunbird.${domain_name}" mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-sunbird.${domain_name}/v1/esignet/oauth2/par" @@ -637,7 +637,7 @@ apps: chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" - image.tag: "develop-go" + image.tag: "0.14.x" mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices.${domain_name}" mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service.esignet-mock" mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet.${domain_name}" @@ -673,7 +673,7 @@ apps: chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" - image.tag: "develop-go" + image.tag: "0.14.x" mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid.${domain_name}" mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid.esignet-mosipid" mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid.${domain_name}" @@ -709,7 +709,7 @@ apps: chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" - image.tag: "develop-go" + image.tag: "0.14.x" mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-sunbird.${domain_name}" mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-sunbird.esignet-sunbird" mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-sunbird.${domain_name}" From 9fe74a9f2d53ae2c88dda019bb83069d6d55a08a Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 7 Sep 2026 15:11:06 +0530 Subject: [PATCH 096/127] Update esignet image to mosipqa/esignet:2.0.x, enable esignet-misp-onboarder with mosipid: true esignet-mock/mosipid/sunbird image changed from mosipdev/esignet:develop-go to mosipqa/esignet:2.0.x. Verified tag exists and renders correctly. esignet-misp-onboarder: enabled: false -> true, onboarding.variables.mosipid: false -> true. Note: namespace stays esignet-mock (unchanged) while this now tells the onboarding job to act in mosipid mode - the namespace/restart-target mismatch and preinstall readiness-wait deadlock documented earlier this session are still unresolved. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 04e828ea2..8b7689c54 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -85,8 +85,8 @@ apps: version: 2.0.0-develop chart: mosip/esignet set: - image.repository: "mosipdev/esignet" - image.tag: "develop-go" + image.repository: "mosipqa/esignet" + image.tag: "2.0.x" enable_insecure: "false" springConfigNameEnv: "" activeProfileEnv: "" @@ -192,8 +192,8 @@ apps: version: 2.0.0-develop chart: mosip/esignet set: - image.repository: "mosipdev/esignet" - image.tag: "develop-go" + image.repository: "mosipqa/esignet" + image.tag: "2.0.x" enable_insecure: "false" springConfigNameEnv: "" activeProfileEnv: "" @@ -306,8 +306,8 @@ apps: version: 2.0.0-develop chart: mosip/esignet set: - image.repository: "mosipdev/esignet" - image.tag: "develop-go" + image.repository: "mosipqa/esignet" + image.tag: "2.0.x" enable_insecure: "false" springConfigNameEnv: "" activeProfileEnv: "" @@ -751,7 +751,7 @@ apps: # After completion, restarts the esignet deployment to pick up the new MISP license key. esignet-misp-onboarder: namespace: esignet-mock - enabled: false + enabled: true version: 0.0.1-develop chart: mosip/partner-onboarder set: @@ -767,7 +767,7 @@ apps: onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.push_reports_to_s3: "true" - onboarding.variables.mosipid: "false" + onboarding.variables.mosipid: "true" # Properties-driven model for inline-hardcoded business values, per # mosip-onboarding@c801268f. Values match the reference # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the From 91ab8ba708f1155f0b0377d97c5ab3a76eb18e0d Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 7 Sep 2026 15:14:26 +0530 Subject: [PATCH 097/127] Point esignet-misp-onboarder's ns_esignet config at esignet-mosipid Part of the namespace-targeting fix for this now-enabled onboarder. Note: the app's own namespace: field (esignet-mock) and the preinstall/ postinstall hooks' ESIGNET_NS default and hardcoded restart-target deployment name are still not updated - those still need addressing separately. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 8b7689c54..42fc71ea7 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -765,7 +765,7 @@ apps: onboarding.configmaps.s3.s3-region: "" onboarding.configmaps.s3.s3-bucket-name: "onboarder" onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mosipid" onboarding.variables.push_reports_to_s3: "true" onboarding.variables.mosipid: "true" # Properties-driven model for inline-hardcoded business values, per From e1cd3a4dfe0df6839a58a1556b5574b8f58d60f2 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 7 Sep 2026 15:46:03 +0530 Subject: [PATCH 098/127] Deploy esignet-misp-onboarder into esignet-mosipid namespace Was esignet-mock. Note: the preinstall/postinstall hook scripts default ESIGNET_NS to esignet-mock internally (no wrapper sets it to esignet-mosipid for this app, unlike the other mosipid-specific hooks), so hook-side prep (namespace creation, keycloak resource copying, readiness wait) will still target the wrong namespace until that's fixed too. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 42fc71ea7..e25c31dd4 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -750,7 +750,7 @@ apps: # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. # After completion, restarts the esignet deployment to pick up the new MISP license key. esignet-misp-onboarder: - namespace: esignet-mock + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/partner-onboarder From 8641a59309ed4b4311dcfbed18b87f4b004c61ce Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 8 Sep 2026 12:01:07 +0530 Subject: [PATCH 099/127] Add MOSIP_ESIGNET_CORS_ALLOWED_ORIGIN_REGEX for esignet-mock/mosipid/sunbird Value uses ${domain_name} instead of a hardcoded domain (same variable used everywhere else in this DSF), with per-instance subdomain regex: ^https?://[^./]+\.${domain_name}$ Written as single-quoted YAML with two literal backslashes before the dot - Helm's --set parser (strvals) consumes one backslash as its own escape character, so a bare "\." gets silently dropped entirely (verified empirically) and an unescaped "." would match any character instead of a literal dot, both of which would weaken the CORS check. Verified the full DSF-to-rendered-manifest chain: exactly one backslash survives, correctly matches the real subdomain and correctly rejects a dot-as-wildcard bypass attempt. Signed-off-by: bhumi46 --- .../dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index e25c31dd4..876135e46 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -106,6 +106,11 @@ apps: domainConfig.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" domainConfig.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" domainConfig.MOSIP_ESIGNET_BASE_URL: "https://esignet.${domain_name}/v1/esignet" + # Single-quoted YAML + two literal backslashes before the dot: strvals (Helm's --set + # parser) consumes one backslash as its own escape character, leaving exactly one in + # the final value - a bare "\." here would be silently dropped, and an unescaped "." + # would match any character instead of a literal dot. Verified via helm template. + extraEnvVars.MOSIP_ESIGNET_CORS_ALLOWED_ORIGIN_REGEX: '^https?://[^./]+\\.${domain_name}$' # esignet-mock has no esignet-global configmap (only the mosipid/sunbird preinstall # hooks create their own per-namespace esignet-global) - these chart-default extraEnvVars # entries are tables (valueFrom.configMapKeyRef against esignet-global), so a plain @@ -221,6 +226,11 @@ apps: domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" domainConfig.MOSIP_ESIGNET_BASE_URL: "https://esignet-mosipid.${domain_name}/v1/esignet" domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" + # Single-quoted YAML + two literal backslashes before the dot: strvals (Helm's --set + # parser) consumes one backslash as its own escape character, leaving exactly one in + # the final value - a bare "\." here would be silently dropped, and an unescaped "." + # would match any character instead of a literal dot. Verified via helm template. + extraEnvVars.MOSIP_ESIGNET_CORS_ALLOWED_ORIGIN_REGEX: '^https?://[^./]+\\.${domain_name}$' # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override # at the same key produces a "cannot overwrite table with non table" coalesce warning @@ -330,6 +340,11 @@ apps: domainConfig.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" domainConfig.MOSIP_ESIGNET_BASE_URL: "https://esignet-sunbird.${domain_name}/v1/esignet" domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + # Single-quoted YAML + two literal backslashes before the dot: strvals (Helm's --set + # parser) consumes one backslash as its own escape character, leaving exactly one in + # the final value - a bare "\." here would be silently dropped, and an unescaped "." + # would match any character instead of a literal dot. Verified via helm template. + extraEnvVars.MOSIP_ESIGNET_CORS_ALLOWED_ORIGIN_REGEX: '^https?://[^./]+\\.${domain_name}$' # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override # at the same key produces a "cannot overwrite table with non table" coalesce warning From 75a96d876d4e819d14a0313f8731af63210ae27f Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 8 Sep 2026 12:37:37 +0530 Subject: [PATCH 100/127] Fix esignet-misp-onboarder to actually target esignet-mosipid Confirmed in a real deploy: the preinstall hook did all its prep (namespace labeling, keycloak resource copying, readiness wait) in esignet-mock, while the Helm release itself deployed into esignet-mosipid (per the DSF's namespace: field) - the postinstall hook then looked for the completed Job in esignet-mock, found nothing, and failed the whole install. - New esignet-misp-onboarder-mosipid-preinstall.sh / -postinstall.sh wrapper scripts (ESIGNET_NS=esignet-mosipid, matching the pattern used for the other mosipid-specific hooks in this DSF); DSF hooks: block now points at these instead of the base scripts directly. - Base postinstall script: parameterized the restart-target deployment name (was hardcoded to esignet-mock) via a new DEPLOYMENT_NAME variable; wrapper sets it to esignet-mosipid. - Base preinstall script: removed the kubectl wait --for=condition=ready step. MISP onboarding writes a license key that esignet consumes on startup - it doesn't call esignet's own API, so waiting for esignet to be ready first was unnecessary and would deadlock once ESIGNET_NS points at esignet-mosipid (whose pod can't become ready without the key this job provides). Signed-off-by: bhumi46 --- .../dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 8 ++++---- .../esignet-misp-onboarder-mosipid-postinstall.sh | 14 ++++++++++++++ .../esignet-misp-onboarder-mosipid-preinstall.sh | 12 ++++++++++++ .../esignet-misp-onboarder-postinstall.sh | 9 +++++---- .../esignet-misp-onboarder-preinstall.sh | 11 ++++++----- 5 files changed, 41 insertions(+), 13 deletions(-) create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 876135e46..585a17721 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -813,10 +813,10 @@ apps: timeout: 600 priority: -6 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh" - preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh" - postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh" - postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh" # Mock RP OIDC Partner Onboarder # Onboards the mock relying party as an OIDC client. diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh new file mode 100755 index 000000000..c483bb902 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# ============================================================================= +# eSignet MISP Partner Onboarder - MOSIPID Post-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid and DEPLOYMENT_NAME=esignet-mosipid, +# then runs the base MISP onboarder post-install (validates job completion, +# restarts the esignet-mosipid deployment to pick up the new MISP license key). +# ============================================================================= +set -euo pipefail + +export ESIGNET_NS="esignet-mosipid" +export DEPLOYMENT_NAME="esignet-mosipid" + +"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh new file mode 100755 index 000000000..099ae01c8 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh @@ -0,0 +1,12 @@ +#!/bin/bash +# ============================================================================= +# eSignet MISP Partner Onboarder - MOSIPID Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid, then runs the base MISP onboarder +# pre-install (copies keycloak resources, cleans up stale artifacts). +# ============================================================================= +set -euo pipefail + +export ESIGNET_NS="esignet-mosipid" + +"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index c6b88a7b2..9b3bb14a0 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -9,6 +9,7 @@ set -euo pipefail ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +DEPLOYMENT_NAME="${DEPLOYMENT_NAME:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - MISP Onboarder Post-install" @@ -39,12 +40,12 @@ else echo "esignet-config-server deployment not found — skipping restart." fi -if kubectl -n "$ESIGNET_NS" get deployment esignet-mock &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-mock - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-mock --timeout=300s +if kubectl -n "$ESIGNET_NS" get deployment "$DEPLOYMENT_NAME" &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment "$DEPLOYMENT_NAME" + kubectl -n "$ESIGNET_NS" rollout status deployment "$DEPLOYMENT_NAME" --timeout=300s echo "esignet deployment restarted." else - echo "esignet deployment not found — skipping restart." + echo "esignet deployment ($DEPLOYMENT_NAME) not found — skipping restart." fi echo "MISP onboarder post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh index a4feb8aa1..d334632ef 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -7,7 +7,12 @@ # - Deletes stale MISP onboarder artifacts from previous runs (idempotency) # - Copies keycloak resources needed by the onboarder Job # - Deletes onboarder-namespace ConfigMap so this release owns it cleanly -# - Waits for the esignet pod to be ready before the Job starts +# Does NOT wait for the esignet pod to be ready: MISP onboarding writes a +# license key that esignet then consumes on startup - it doesn't call +# esignet's own API, so it doesn't need esignet up first. Waiting here would +# deadlock when the pod can't become ready without the key this job provides +# (empty MOSIP_ESIGNET_MISP_KEY makes esignet Fatal before /health ever +# serves). # Only used with mosip-identity-plugin (plugin 2). # ============================================================================= set -euo pipefail @@ -47,8 +52,4 @@ $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" # Delete onboarder-namespace ConfigMap so this release owns it with the correct annotation kubectl -n "$ESIGNET_NS" delete configmap onboarder-namespace --ignore-not-found=true -# Verify eSignet service is running before the onboarder Job starts -kubectl -n "$ESIGNET_NS" wait --for=condition=ready pod -l app.kubernetes.io/name=esignet --timeout=480s || \ - { echo "ERROR: eSignet pods not ready after timeout" >&2; exit 1; } - echo "MISP onboarder pre-install completed." From 2e01a49069ad44b6f84ed420088405c60cbe5a18 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 8 Sep 2026 13:23:27 +0530 Subject: [PATCH 101/127] Point esignet-misp-onboarder at mosipid's own domain/Keycloak, not mock/shared Two real bugs found from an actual failed deploy: the job's own log showed EXTERNAL_URL/URL/AUTHMANAGER_URL/PMS_URL all resolving to mock's/the local shared domain instead of esignet-mosipid's, and it authenticated against the shared local Keycloak using placeholder credentials. domainConfig.mosip-esignet-host/mosip-api-internal-host: these are read directly by the onboarding script (rendered as plain env vars by the chart's templates/jobs.yaml) to derive EXTERNAL_URL and the PMS/IDA/authmanager URLs - now point at esignet-mosipid's real values (esignet-mosipid.${domain_name}, api-internal.${mosipid_domain_name}). Keycloak target: switched from the shared keycloak/keycloak-client-secrets secrets to mosipid's own. keycloak-host-mosipid/keycloak-client-secrets-mosipid already existed (created by esignet-mosipid-preinstall.sh, which runs earlier) and are now referenced directly - no copy needed. Added a new keycloak-mosipid secret (admin-password key) since no stored secret for mosipid's Keycloak admin password existed anywhere; sourced from MOSIPID_KEYCLOAK_ADMIN_PASSWORD, the same env var esignet-mosipid-preinstall.sh already requires. Base preinstall script gained a SKIP_SHARED_KEYCLOAK_SECRETS flag so the mosipid wrapper can opt out of the shared-secret copy while keycloak-env-vars (generic, no per-instance equivalent exists) stays shared. Verified via helm template: all four secretRef/configMapRef names resolve to the mosipid-specific resources, mosip-esignet-host/mosip-api-internal-host render with the correct mosipid values, clean exit, no warnings. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 14 +++++++++----- ...esignet-misp-onboarder-mosipid-preinstall.sh | 17 ++++++++++++++++- .../esignet-misp-onboarder-preinstall.sh | 12 +++++++++--- 3 files changed, 34 insertions(+), 9 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 585a17721..d6eef45a8 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -799,12 +799,16 @@ apps: onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpassword" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" - extraEnvVarsCM[1]: "keycloak-host" - extraEnvVarsSecret[0]: "keycloak" - extraEnvVarsSecret[1]: "keycloak-client-secrets" - domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" + extraEnvVarsCM[1]: "keycloak-host-mosipid" + extraEnvVarsSecret[0]: "keycloak-mosipid" + extraEnvVarsSecret[1]: "keycloak-client-secrets-mosipid" + # mosip-esignet-host/mosip-api-internal-host are read by the onboarding script itself + # to derive EXTERNAL_URL/URL/AUTHMANAGER_URL/PMS_URL (confirmed via the chart's + # templates/jobs.yaml, which renders every domainConfig entry as a plain env var) - + # point them at esignet-mosipid's real values, not the generic/mock ones. + domainConfig.mosip-api-internal-host: "api-internal.${mosipid_domain_name}" domainConfig.mosip-api-host: "api.${domain_name}" - domainConfig.mosip-esignet-host: "esignet.${domain_name}" + domainConfig.mosip-esignet-host: "esignet-mosipid.${domain_name}" domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" domainConfig.mosip-resident-host: "resident.${domain_name}" domainConfig.installation-domain: "${domain_name}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh index 099ae01c8..e1af1bb47 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh @@ -3,10 +3,25 @@ # eSignet MISP Partner Onboarder - MOSIPID Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid, then runs the base MISP onboarder -# pre-install (copies keycloak resources, cleans up stale artifacts). +# pre-install (copies keycloak resources, cleans up stale artifacts). Skips +# the shared Keycloak admin/client secrets - this onboarder authenticates +# against mosipid's own dedicated Keycloak instead: +# - keycloak-host-mosipid / keycloak-client-secrets-mosipid already exist in +# esignet-mosipid (created by esignet-mosipid-preinstall.sh, which runs +# earlier), referenced directly via the DSF's extraEnvVarsCM/Secret. +# - keycloak-mosipid (admin-password) is created here, since no stored +# secret for mosipid's Keycloak admin password exists yet anywhere. # ============================================================================= set -euo pipefail export ESIGNET_NS="esignet-mosipid" +export SKIP_SHARED_KEYCLOAK_SECRETS="true" + +MOSIPID_KC_ADMIN_PASS="${MOSIPID_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID_KEYCLOAK_ADMIN_PASSWORD must be set}" "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh" + +echo "Creating keycloak-mosipid secret (admin-password) in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-mosipid \ + --from-literal=admin-password="${MOSIPID_KC_ADMIN_PASS}" \ + --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh index d334632ef..bd287db96 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -44,10 +44,16 @@ kubectl -n "$ESIGNET_NS" delete configmap esignet-onboarder-config --ignore-not- kubectl -n "$ESIGNET_NS" delete secret esignet-onboarder-secrets --ignore-not-found=true echo "Stale MISP onboarder artifacts cleaned up." -# Copy keycloak resources needed by the onboarder Job +# Copy keycloak resources needed by the onboarder Job. keycloak-env-vars is generic/ +# realm-agnostic (no per-instance equivalent exists anywhere in this DSF) so it always +# comes from the shared keycloak namespace. The admin secret and client secrets are +# skippable via SKIP_SHARED_KEYCLOAK_SECRETS for instances (like mosipid) that +# authenticate against their own dedicated Keycloak instead. $COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$ESIGNET_NS" -$COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" -$COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" +if [ "${SKIP_SHARED_KEYCLOAK_SECRETS:-false}" != "true" ]; then + $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" + $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" +fi # Delete onboarder-namespace ConfigMap so this release owns it with the correct annotation kubectl -n "$ESIGNET_NS" delete configmap onboarder-namespace --ignore-not-found=true From c7ca03a370c17b31dac43a569359f067e5db9633 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 8 Sep 2026 14:37:02 +0530 Subject: [PATCH 102/127] Set esignet-misp-onboarder PARTNER_MANAGER_USERNAME/PASSWORD Replaced the placeholder esignet-kc-mockusername/mockpassword values. Confirmed with the user this isn't a sensitive credential. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index d6eef45a8..e15a2a946 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -787,16 +787,15 @@ apps: # mosip-onboarding@c801268f. Values match the reference # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to - # this instance. PARTNER_MANAGER_USERNAME/PASSWORD are placeholders pending real - # Keycloak credentials for this onboarding job. + # this instance. onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignet" onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignet" onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignet" onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusername" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpassword" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "abisheksss" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "abisheksss" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host-mosipid" From 647c0eb5b76cd927a5f32fb0dcea8acaa0354c58 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 8 Sep 2026 14:48:02 +0530 Subject: [PATCH 103/127] Update esignet-misp-onboarder propertiesOverride values with -ka suffix POLICY_NAME/POLICY_GROUP_NAME/PARTNER_KC_USERNAME/PARTNER_MANAGER_USERNAME/ PARTNER_MANAGER_PASSWORD updated. PARTNER_ORGANIZATION_NAME/PARTNER_TYPE/ PARTNER_DOMAIN/EXTERNAL_URL unchanged. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index e15a2a946..c0573185e 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -788,14 +788,14 @@ apps: # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to # this instance. - onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignet" - onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignet" - onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignet" + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetka" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetka" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetka" onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "abisheksss" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "abisheksss" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernameka" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordka" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host-mosipid" From 25eeb12bce1120e517c3f5c42bb9b394e4d0cc04 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 8 Sep 2026 15:24:00 +0530 Subject: [PATCH 104/127] esignetka -> esignetkaa in esignet-misp-onboarder propertiesOverride POLICY_NAME/POLICY_GROUP_NAME/PARTNER_KC_USERNAME. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index c0573185e..f4d47a37b 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -788,9 +788,9 @@ apps: # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to # this instance. - onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetka" - onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetka" - onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetka" + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkaa" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkaa" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkaa" onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" From 9fcc1a01729ad6661b87ff3b7cf17c9091e350dd Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 8 Sep 2026 15:38:43 +0530 Subject: [PATCH 105/127] PARTNER_MANAGER_USERNAME/PASSWORD -ka -> -kaa for esignet-misp-onboarder Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index f4d47a37b..74bf7701a 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -794,8 +794,8 @@ apps: onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernameka" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordka" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekaa" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkaa" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host-mosipid" From 99d8190a8df958d5537f589741380736f390abd5 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 12:26:52 +0530 Subject: [PATCH 106/127] kaa -> kaaa for esignet-misp-onboarder propertiesOverride values Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 74bf7701a..ae43d6c78 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -788,14 +788,14 @@ apps: # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to # this instance. - onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkaa" - onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkaa" - onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkaa" + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkaaa" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkaaa" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkaaa" onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekaa" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkaa" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekaaa" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkaaa" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host-mosipid" From 518649228d790fecd638459e212b89143a1066f3 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 12:44:40 +0530 Subject: [PATCH 107/127] kaaa -> kaaaa for esignet-misp-onboarder propertiesOverride values Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index ae43d6c78..6f49ea393 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -788,14 +788,14 @@ apps: # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to # this instance. - onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkaaa" - onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkaaa" - onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkaaa" + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkaaaa" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkaaaa" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkaaaa" onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekaaa" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkaaa" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekaaaa" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkaaaa" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host-mosipid" From 0c9b70a6ae4d21773f1031cb33716ab68b26a871 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 12:59:05 +0530 Subject: [PATCH 108/127] Target only the latest job/pod in esignet-misp-onboarder-postinstall.sh Old completed jobs/pods from previous runs aren't cleaned up, so every run since accumulates another match for the app.kubernetes.io/instance label. JOB_STATUS previously used .items[0] (not guaranteed to be the latest), and the failure-path log fetch used a bare -l selector that concatenated tail(30) from every stale pod, making real failures hard to find in a wall of old, unrelated log output. Both now sort by creationTimestamp and target only the newest job/pod. Not independently verified against a live cluster (no access from here) - .items[-1:] is a standard kubectl jsonpath idiom, but flagging since it wasn't tested the way the DSF changes usually are. Signed-off-by: bhumi46 --- .../esignet-misp-onboarder-postinstall.sh | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index 9b3bb14a0..b85035789 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -15,17 +15,28 @@ echo "================================================" echo "eSignet 1.7.1 - MISP Onboarder Post-install" echo "================================================" +# Jobs/pods from previous runs aren't cleaned up automatically, so multiple can match +# this label at once - always sort by creation time and take the newest (.items[-1]), +# not .items[0] (API-returned order isn't guaranteed to be latest-last) or a bare -l +# selector (which would match every stale pod too, producing confusing concatenated logs). JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ -l app.kubernetes.io/instance=esignet-misp-onboarder \ - -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") + --sort-by=.metadata.creationTimestamp \ + -o jsonpath='{.items[-1:].status.succeeded}' 2>/dev/null || echo "") # Always restore namespace injection before returning from this hook. kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite echo "Istio injection re-enabled on namespace $ESIGNET_NS." if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then - echo "WARNING: onboarding job may not have completed. Check logs:" - kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder --tail=30 2>/dev/null || true + echo "WARNING: onboarding job may not have completed. Check logs from the latest pod only:" + LATEST_POD=$(kubectl -n "$ESIGNET_NS" get pods \ + -l app.kubernetes.io/instance=esignet-misp-onboarder \ + --sort-by=.metadata.creationTimestamp \ + -o jsonpath='{.items[-1:].metadata.name}' 2>/dev/null || echo "") + if [ -n "$LATEST_POD" ]; then + kubectl -n "$ESIGNET_NS" logs "$LATEST_POD" --tail=30 2>/dev/null || true + fi exit 1 fi echo "eSignet MISP partner onboarding completed successfully." From 9ed5b72047bf7c5c7a6d46ee7f17f8db23c7ddd7 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 13:21:05 +0530 Subject: [PATCH 109/127] kaaaa -> kaaaaa for esignet-misp-onboarder propertiesOverride values Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 6f49ea393..a7693d436 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -788,14 +788,14 @@ apps: # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to # this instance. - onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkaaaa" - onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkaaaa" - onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkaaaa" + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkaaaaa" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkaaaaa" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkaaaaa" onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekaaaa" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkaaaa" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekaaaaa" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkaaaaa" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host-mosipid" From 74335f1dd518db9b13941e1e5273581483e22b7d Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 13:37:44 +0530 Subject: [PATCH 110/127] Fix jsonpath latest-job/pod lookup in esignet-misp-onboarder-postinstall.sh The previous {.items[-1:].field} slice-plus-field-access pattern silently returned nothing in a real run, leaving LATEST_POD empty and no logs printed after the WARNING. Switch to the standard range+end idiom. Signed-off-by: bhumi46 --- .../esignet-misp-onboarder-postinstall.sh | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index b85035789..968cf0b3b 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -16,13 +16,17 @@ echo "eSignet 1.7.1 - MISP Onboarder Post-install" echo "================================================" # Jobs/pods from previous runs aren't cleaned up automatically, so multiple can match -# this label at once - always sort by creation time and take the newest (.items[-1]), -# not .items[0] (API-returned order isn't guaranteed to be latest-last) or a bare -l -# selector (which would match every stale pod too, producing confusing concatenated logs). +# this label at once - always sort by creation time and take the newest, not the +# API-returned .items[0] (order isn't guaranteed) or a bare -l selector (which would +# match every stale pod too, producing confusing concatenated logs). Using +# range+tail -1 rather than a jsonpath slice index (e.g. items[-1:].field): applying a +# field accessor directly after a slice doesn't reliably drill into the single +# resulting element in kubectl's jsonpath engine - confirmed empirically, it silently +# returned nothing. JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ -l app.kubernetes.io/instance=esignet-misp-onboarder \ --sort-by=.metadata.creationTimestamp \ - -o jsonpath='{.items[-1:].status.succeeded}' 2>/dev/null || echo "") + -o jsonpath='{range .items[*]}{.status.succeeded}{"\n"}{end}' 2>/dev/null | tail -1) # Always restore namespace injection before returning from this hook. kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite @@ -33,7 +37,7 @@ if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then LATEST_POD=$(kubectl -n "$ESIGNET_NS" get pods \ -l app.kubernetes.io/instance=esignet-misp-onboarder \ --sort-by=.metadata.creationTimestamp \ - -o jsonpath='{.items[-1:].metadata.name}' 2>/dev/null || echo "") + -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null | tail -1) if [ -n "$LATEST_POD" ]; then kubectl -n "$ESIGNET_NS" logs "$LATEST_POD" --tail=30 2>/dev/null || true fi From 7e035f690c688678c06f0c6795a2c117c37f821e Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 13:41:06 +0530 Subject: [PATCH 111/127] kaaaaa -> kaaaaaa for esignet-misp-onboarder propertiesOverride values Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index a7693d436..3f9df84dc 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -788,14 +788,14 @@ apps: # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to # this instance. - onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkaaaaa" - onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkaaaaa" - onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkaaaaa" + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkaaaaaa" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkaaaaaa" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkaaaaaa" onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekaaaaa" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkaaaaa" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekaaaaaa" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkaaaaaa" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host-mosipid" From 4c727efe8ceef8d4d3a0e5458be4ca2480e8392e Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 14:18:22 +0530 Subject: [PATCH 112/127] Surface pod status and full container termination reason in esignet-misp-onboarder-postinstall.sh --tail=30 alone doesn't say WHY the container died (e.g. OOMKilled vs a normal script failure), forcing a manual kubectl round-trip against the live cluster every time. Print containerStatuses.state/lastState and bump the log tail to 200 lines so the CI output is self-sufficient. Signed-off-by: bhumi46 --- .../esignet-misp-onboarder-postinstall.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index 968cf0b3b..3f2e85d6b 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -39,7 +39,11 @@ if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then --sort-by=.metadata.creationTimestamp \ -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null | tail -1) if [ -n "$LATEST_POD" ]; then - kubectl -n "$ESIGNET_NS" logs "$LATEST_POD" --tail=30 2>/dev/null || true + echo "--- pod/container status (state, restarts, last termination reason/exit code) ---" + kubectl -n "$ESIGNET_NS" get pod "$LATEST_POD" \ + -o jsonpath='phase={.status.phase}{"\n"}{range .status.containerStatuses[*]}container={.name} restartCount={.restartCount}{"\n"}state={.state}{"\n"}lastState={.lastState}{"\n"}{end}' 2>/dev/null || true + echo "--- pod logs (last 200 lines) ---" + kubectl -n "$ESIGNET_NS" logs "$LATEST_POD" --tail=200 2>/dev/null || true fi exit 1 fi From 91cc475ca09bc27805b80ecd7d81ddafec9b6008 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 14:25:56 +0530 Subject: [PATCH 113/127] Fail safe on JOB_STATUS/LATEST_POD lookups in esignet-misp-onboarder-postinstall.sh Under set -euo pipefail, a genuine kubectl API failure (not just "no jobs/pods found") on either lookup would abort the script before the istio-injection restore ran. Add || true so only istio-injection restore and the diagnostic path run, matching the rest of the script. Signed-off-by: bhumi46 --- .../esignet-misp-onboarder-postinstall.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index 3f2e85d6b..90c4072db 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -22,11 +22,14 @@ echo "================================================" # range+tail -1 rather than a jsonpath slice index (e.g. items[-1:].field): applying a # field accessor directly after a slice doesn't reliably drill into the single # resulting element in kubectl's jsonpath engine - confirmed empirically, it silently -# returned nothing. +# returned nothing. Trailing `|| true`: under set -euo pipefail, a genuine kubectl API +# failure (not just "no jobs found") would otherwise abort the script here, skipping the +# istio-injection restore below - an empty JOB_STATUS already routes into the same +# WARNING/diagnostic path as "job not done", which is the right outcome either way. JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ -l app.kubernetes.io/instance=esignet-misp-onboarder \ --sort-by=.metadata.creationTimestamp \ - -o jsonpath='{range .items[*]}{.status.succeeded}{"\n"}{end}' 2>/dev/null | tail -1) + -o jsonpath='{range .items[*]}{.status.succeeded}{"\n"}{end}' 2>/dev/null | tail -1) || true # Always restore namespace injection before returning from this hook. kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite @@ -37,7 +40,7 @@ if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then LATEST_POD=$(kubectl -n "$ESIGNET_NS" get pods \ -l app.kubernetes.io/instance=esignet-misp-onboarder \ --sort-by=.metadata.creationTimestamp \ - -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null | tail -1) + -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null | tail -1) || true if [ -n "$LATEST_POD" ]; then echo "--- pod/container status (state, restarts, last termination reason/exit code) ---" kubectl -n "$ESIGNET_NS" get pod "$LATEST_POD" \ From eb55f6722dd619df80cd0e31b56279895444cf3c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 14:28:34 +0530 Subject: [PATCH 114/127] kaaaaaa -> kb for esignet-misp-onboarder propertiesOverride values Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 3f9df84dc..888cba931 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -788,14 +788,14 @@ apps: # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to # this instance. - onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkaaaaaa" - onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkaaaaaa" - onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkaaaaaa" + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkb" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkb" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkb" onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekaaaaaa" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkaaaaaa" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekb" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkb" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host-mosipid" From 78fcf1acb281a37b608f49917c7e6485f91eb8fc Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 14:45:53 +0530 Subject: [PATCH 115/127] Wait for the onboarding job to reach a terminal state before checking its result helm upgrade returns as soon as the Job object is created, not when it finishes. The real run's diagnostics (added in the previous commit) showed phase=Running/restartCount=0/lastState={} with newman only one request into its first folder - the job was never failing, we were just checking way too early. Poll status.succeeded/status.failed for up to 10 minutes (configurable via ONBOARDER_JOB_WAIT_TIMEOUT) instead of checking once immediately. Signed-off-by: bhumi46 --- .../esignet-misp-onboarder-postinstall.sh | 30 +++++++++++++++++-- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index 90c4072db..468a8aea2 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -10,6 +10,15 @@ set -euo pipefail ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" DEPLOYMENT_NAME="${DEPLOYMENT_NAME:-esignet-mock}" +# The onboarding job runs a long newman flow (~15 folders, each with one or more +# requests, plus a mandatory 2s --delay-request between every request) that easily +# takes several minutes end to end. helm upgrade returns as soon as the Job object is +# created, not when it finishes, so checking job status immediately reports a false +# failure while the job is still mid-flight - confirmed via a real run that showed +# phase=Running/restartCount=0/lastState={} with newman only one request into its very +# first folder. Poll until the job reaches a terminal state instead of checking once. +ONBOARDER_JOB_WAIT_TIMEOUT="${ONBOARDER_JOB_WAIT_TIMEOUT:-600}" +ONBOARDER_JOB_POLL_INTERVAL=10 echo "================================================" echo "eSignet 1.7.1 - MISP Onboarder Post-install" @@ -24,12 +33,27 @@ echo "================================================" # resulting element in kubectl's jsonpath engine - confirmed empirically, it silently # returned nothing. Trailing `|| true`: under set -euo pipefail, a genuine kubectl API # failure (not just "no jobs found") would otherwise abort the script here, skipping the -# istio-injection restore below - an empty JOB_STATUS already routes into the same +# istio-injection restore below - an empty LATEST_JOB already routes into the same # WARNING/diagnostic path as "job not done", which is the right outcome either way. -JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ +LATEST_JOB=$(kubectl -n "$ESIGNET_NS" get jobs \ -l app.kubernetes.io/instance=esignet-misp-onboarder \ --sort-by=.metadata.creationTimestamp \ - -o jsonpath='{range .items[*]}{.status.succeeded}{"\n"}{end}' 2>/dev/null | tail -1) || true + -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null | tail -1) || true + +JOB_STATUS="" +if [ -n "$LATEST_JOB" ]; then + echo "Waiting up to ${ONBOARDER_JOB_WAIT_TIMEOUT}s for job/$LATEST_JOB to reach a terminal state..." + ELAPSED=0 + while [ "$ELAPSED" -lt "$ONBOARDER_JOB_WAIT_TIMEOUT" ]; do + JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get job "$LATEST_JOB" -o jsonpath='{.status.succeeded}' 2>/dev/null) || true + JOB_FAILED=$(kubectl -n "$ESIGNET_NS" get job "$LATEST_JOB" -o jsonpath='{.status.failed}' 2>/dev/null) || true + if [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]] || [[ "$JOB_FAILED" =~ ^[1-9][0-9]*$ ]]; then + break + fi + sleep "$ONBOARDER_JOB_POLL_INTERVAL" + ELAPSED=$((ELAPSED + ONBOARDER_JOB_POLL_INTERVAL)) + done +fi # Always restore namespace injection before returning from this hook. kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite From 1e9abec775178d8ba1bd65cc0a0359fcc2836159 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 15:34:41 +0530 Subject: [PATCH 116/127] Reduce ONBOARDER_JOB_WAIT_TIMEOUT default from 600s to 300s Signed-off-by: bhumi46 --- .../esignet-misp-onboarder-postinstall.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index 468a8aea2..4fe56bdff 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -17,7 +17,7 @@ DEPLOYMENT_NAME="${DEPLOYMENT_NAME:-esignet-mock}" # failure while the job is still mid-flight - confirmed via a real run that showed # phase=Running/restartCount=0/lastState={} with newman only one request into its very # first folder. Poll until the job reaches a terminal state instead of checking once. -ONBOARDER_JOB_WAIT_TIMEOUT="${ONBOARDER_JOB_WAIT_TIMEOUT:-600}" +ONBOARDER_JOB_WAIT_TIMEOUT="${ONBOARDER_JOB_WAIT_TIMEOUT:-300}" ONBOARDER_JOB_POLL_INTERVAL=10 echo "================================================" From fac198254066b0ebd3304592c8a9487058cf0ffd Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 15:34:41 +0530 Subject: [PATCH 117/127] kb -> kc for esignet-misp-onboarder propertiesOverride values Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 888cba931..82934316c 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -788,14 +788,14 @@ apps: # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to # this instance. - onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkb" - onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkb" - onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkb" + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkc" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkc" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkc" onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekb" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkb" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekc" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkc" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host-mosipid" From a1c3d350c27b232c7513c5a9e67d0b7db196ce00 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 16:13:46 +0530 Subject: [PATCH 118/127] kc -> kd for esignet-misp-onboarder propertiesOverride values Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 82934316c..d0f51bcc3 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -788,14 +788,14 @@ apps: # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to # this instance. - onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkc" - onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkc" - onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkc" + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkd" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkd" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkd" onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekc" - onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkc" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekd" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkd" onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host-mosipid" From 03fddac71984c5239de67c65c23bacf996c845e4 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 16:59:23 +0530 Subject: [PATCH 119/127] Fix AUTHORIZE_ENDPOINT/CODE_CHALLENGE not reaching mock-relying-party-ui containers mock_relying_party_ui.AUTHORIZE_ENDPOINT/CODE_CHALLENGE only exist as values.yaml defaults in the mock-relying-party-ui chart - deployment.yaml's env: block hardcodes a specific list of mock_relying_party_ui.* keys and never references these two, so setting them had no effect on the running container. Switch to extraEnvVars.*, which the chart does wire into env:. Verified via helm template that AUTHORIZE_ENDPOINT/CODE_CHALLENGE now render as real container env vars. Signed-off-by: bhumi46 --- .../dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index d0f51bcc3..cb4c745d3 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -672,8 +672,8 @@ apps: mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' mock_relying_party_ui.DEFAULT_LANG: en mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' - mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize - mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge + extraEnvVars.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + extraEnvVars.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices.${domain_name}" wait: true timeout: 480 @@ -708,8 +708,8 @@ apps: mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' mock_relying_party_ui.DEFAULT_LANG: en mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' - mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize - mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge + extraEnvVars.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + extraEnvVars.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-mosipid.${domain_name}" wait: true timeout: 480 @@ -744,8 +744,8 @@ apps: mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' mock_relying_party_ui.DEFAULT_LANG: en mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' - mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize - mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge + extraEnvVars.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + extraEnvVars.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-sunbird.${domain_name}" wait: true timeout: 480 From 57f9a0d340256924e1e655731578e9c99421213f Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 9 Sep 2026 18:05:30 +0530 Subject: [PATCH 120/127] Add TOKEN_ENDPOINT/USERINFO_ENDPOINT for mock-relying-party-service mock_relying_party_service.TOKEN_ENDPOINT/USERINFO_ENDPOINT only exist as values.yaml defaults in the chart - deployment.yaml's env: block never references them, only ESIGNET_SERVICE_URL/ESIGNET_AUD_URL/ CLIENT_PRIVATE_KEY/JWE_USERINFO_PRIVATE_KEY/USERINFO_RESPONSE_TYPE are hardcoded there. Add via extraEnvVars.*, already the pattern this DSF uses for the chart's other keys. Verified via helm template that both render as real container env vars. ESIGNET_AUD_URL is already present and wired correctly (deployment.yaml does reference mock_relying_party_service.ESIGNET_AUD_URL directly) with per-instance domain-parameterized values, so left unchanged. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index cb4c745d3..6bddb661c 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -565,6 +565,8 @@ apps: extraEnvVars.CLAIMS_LOCALES: "en" extraEnvVars.SCOPE_USER_PROFILE: "openid profile" extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' + extraEnvVars.TOKEN_ENDPOINT: "/oauth2/token" + extraEnvVars.USERINFO_ENDPOINT: "/oauth2/userinfo" mock_relying_party_service.host: "" mock_relying_party_service.mountDir: "" mock_relying_party_service.healthCheckUrl: null @@ -599,6 +601,8 @@ apps: extraEnvVars.CLAIMS_LOCALES: "en" extraEnvVars.SCOPE_USER_PROFILE: "openid profile" extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' + extraEnvVars.TOKEN_ENDPOINT: "/oauth2/token" + extraEnvVars.USERINFO_ENDPOINT: "/oauth2/userinfo" mock_relying_party_service.host: "" mock_relying_party_service.mountDir: "" mock_relying_party_service.healthCheckUrl: null @@ -633,6 +637,8 @@ apps: extraEnvVars.CLAIMS_LOCALES: "en" extraEnvVars.SCOPE_USER_PROFILE: "openid profile" extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' + extraEnvVars.TOKEN_ENDPOINT: "/oauth2/token" + extraEnvVars.USERINFO_ENDPOINT: "/oauth2/userinfo" mock_relying_party_service.host: "" mock_relying_party_service.mountDir: "" mock_relying_party_service.healthCheckUrl: null From 53c510315c255263f28f842c1158cec36ac3d7de Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 24 Sep 2026 15:47:08 +0530 Subject: [PATCH 121/127] Document esignet-standalone-2.0.0 profile support in testrigs guide HELMSMAN_TESTRIGS_GUIDE.md was updated for the mosipid1/mosipid2 -> mosipid rename but never gained a row for esignet-standalone-2.0.0, even though helmsman_testrigs.yml's profile dropdown already supports it and Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml deploys the exact same apps into the exact same namespaces (only the hook scripts differ). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS Signed-off-by: bhumi46 --- docs/HELMSMAN_TESTRIGS_GUIDE.md | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/docs/HELMSMAN_TESTRIGS_GUIDE.md b/docs/HELMSMAN_TESTRIGS_GUIDE.md index d171783ed..26660a709 100644 --- a/docs/HELMSMAN_TESTRIGS_GUIDE.md +++ b/docs/HELMSMAN_TESTRIGS_GUIDE.md @@ -15,10 +15,13 @@ Deploy API, UI, and DSL test rigs after all services are running and partner onb | Profile | What deploys | Namespaces | |---------|-------------|------------| | `esignet-standalone` | `esignet-apitestrig` into 3 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid`, `esignet-sunbird`, `signup` | +| `esignet-standalone-2.0.0` | Identical to `esignet-standalone` (Go rewrite) | Same namespaces as above | | `mosip-platform-1.2.0.x` | API testrig, UI testrig, DSL testrig | MOSIP testrig namespaces | | `mosip-platform-1.2.1.x` | Same as above | MOSIP testrig namespaces | -> **eSignet standalone (`esignet-standalone` profile):** Requires `mosipid_domain_name` for the MOSIP-ID apitestrig endpoint. +> **eSignet standalone (`esignet-standalone` / `esignet-standalone-2.0.0` profiles):** Requires `mosipid_domain_name` for the MOSIP-ID apitestrig endpoint. +> +> **`esignet-standalone-2.0.0` note:** `testrigs-dsf.yaml` deploys the exact same apps into the exact same namespaces as `esignet-standalone` — only the hook scripts differ (`hooks/esignet-standalone-2.0.0/` instead of `hooks/esignet-standalone/`). --- @@ -62,7 +65,7 @@ No additional secrets required — MinIO root password is read automatically fro | Input | Description | Example | |-------|-------------|---------| -| `profile` | Deployment profile | `esignet-standalone` / `mosip-platform-1.2.0.x` / `mosip-platform-1.2.1.x` | +| `profile` | Deployment profile | `esignet-standalone` / `esignet-standalone-2.0.0` / `mosip-platform-1.2.0.x` / `mosip-platform-1.2.1.x` | | `mode` | Helmsman mode | Always `apply` — dry-run will fail | | `domain_name` | Base domain for this environment | `soil38.mosip.net` | | `db_port` | External postgres port — MOSIP platform only | `5433` | @@ -70,7 +73,7 @@ No additional secrets required — MinIO root password is read automatically fro | `env_name` | Environment name | `soil38` | | `slack_channel_name` | Slack channel for alerting (optional) | `#mosip-alerts` | -### eSignet standalone profile additionally +### eSignet standalone profiles (`esignet-standalone` / `esignet-standalone-2.0.0`) additionally | Input | Description | Example | |-------|-------------|---------| @@ -88,7 +91,7 @@ No additional secrets required — MinIO root password is read automatically fro > Can't find it? Search for "Testrig" or "Testrigs" in the workflows list. - **(2)** Click the **Run workflow** dropdown button (top right) — this opens the form shown above. - **(3)** **Branch** — pick the branch you're deploying from (e.g., `MOSIP-44613`). -- **(4)** **Deployment profile to use** — pick the profile you want (e.g., `mosip-platform-1.2.0.x` or `esignet-standalone`). +- **(4)** **Deployment profile to use** — pick the profile you want (e.g., `mosip-platform-1.2.0.x`, `esignet-standalone`, or `esignet-standalone-2.0.0` for the Go rewrite). - **(5)** **Choose Helmsman mode: dry-run or apply** — always pick **`apply`**. - **(6)** **Domain name for this environment** — type the web domain this environment should use (e.g., `example.xyz.net`). - **(7)** **MOSIP-ID domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID eSignet instance (e.g., `mosipid.xyz.net`). Leave blank for MOSIP platform profiles. @@ -136,7 +139,7 @@ kubectl create job --from=cronjob/cronjob-dslorchestrator-full dslrig-manual-run > kubectl logs -f job/dslrig-manual-run -n dslrig > ``` -**3. Trigger eSignet test jobs (eSignet standalone profile)** +**3. Trigger eSignet test jobs (eSignet standalone profiles)** The `trigger-test-jobs-esignet.sh` postInstall hook fires automatically after the last testrig deploys — it triggers all cronjobs across all 3 esignet namespaces sequentially and optionally signup/signup-uitestrig if deployed. @@ -145,7 +148,12 @@ To trigger manually: ```bash export KUBECONFIG=/path/to/kubeconfig export WORKDIR=/path/to/Helmsman + +# esignet-standalone ./hooks/esignet-standalone/trigger-test-jobs-esignet.sh + +# esignet-standalone-2.0.0 +./hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh ``` --- @@ -158,7 +166,7 @@ kubectl get pods -n apitestrig kubectl get pods -n uitestrig kubectl get pods -n dslrig -# Check testrig pods (eSignet standalone) +# Check testrig pods (eSignet standalone — same namespaces for esignet-standalone-2.0.0) kubectl get pods -n esignet # esignet-apitestrig cronjob kubectl get pods -n esignet-mosipid kubectl get pods -n esignet-sunbird From 83e8ab6c874c3fffd0d5620182d1e477cfaa979d Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 24 Sep 2026 17:26:51 +0530 Subject: [PATCH 122/127] esignet-standalone-2.0.0: use eSignet's own apitestrig/uitestrig charts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the generic mosip/apitestrig chart with eSignet's own dedicated mosip/esignet-apitestrig (Go harness) chart, and add mosip/esignet-uitestrig (Java harness) — neither existed in this profile's testrigs-dsf.yaml before, which had just copy-pasted the esignet-standalone (1.0/Java) profile's generic-chart config unmodified. Modeled directly on: https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh - testrigs-dsf.yaml: 3 apitestrig apps (mock/mosipid/sunbird, each in the eSignet instance's own namespace) now use mosip/esignet-apitestrig 2.0.0 with the correct configFile per instance (config.mock/mosip/sunbird.json). 3 new uitestrig apps use mosip/esignet-uitestrig 2.0.0, each in its own namespace (esignet-uitestrig/esignet-mosipid-uitestrig/esignet-sunbird-uitestrig), matching install.sh's own NS/SOURCE_NS split. Only esignet-mosipid (the only instance backed by a real IDA identity) gets real test-identity/onboarding values — esignet-mock and esignet-sunbird need none. - KEYCLOAK_CLIENT_SECRET reuses the existing PMS_CLIENT_SECRET_VALUE convention (same mosip_pms_client_secret key esignet-preinstall-keycloak-init.sh already reads); consent DB password reuses db-common-secrets/db-dbuser-password (same secret helmsman_esignet.yml's own DB-password step reads). Both fetched fresh in new helmsman_testrigs.yml steps since testrigs always run after eSignet DSF has completed. - apitestrig/uitestrig preInstall hooks are now much lighter: the new charts manage their own Secret/ConfigMap from set: values directly, so hooks only need to clean up the old chart's unmanaged CM/secret leftovers (apitestrig) or bootstrap the new namespace (uitestrig) — no more pre-staging secrets. - trigger-test-jobs-esignet.sh now also triggers the 3 new uitestrig namespaces. - helmsman_testrigs.yml: new required Environment secrets/vars for the mosipid-only test identity plus the shared UI-testrig OIDC client, validated up front with a clear error listing what's missing. - docs/HELMSMAN_TESTRIGS_GUIDE.md: documents all of the above — the profile table, the new namespaces, and every new required secret/variable. Report storage uses reports.persistence (PVC) rather than reports.s3 — no established MinIO bucket convention exists yet for these charts in this repo. Signed-off-by: bhumi46 Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS --- .github/workflows/helmsman_testrigs.yml | 84 +++++ .../testrigs-dsf.yaml | 294 +++++++++++------- .../apitestrig-esignet-mosipid-setup.sh | 36 +-- .../apitestrig-esignet-setup.sh | 36 +-- .../apitestrig-esignet-sunbird-setup.sh | 36 +-- .../trigger-test-jobs-esignet.sh | 13 +- .../uitestrig-esignet-mosipid-setup.sh | 27 ++ .../uitestrig-esignet-setup.sh | 27 ++ .../uitestrig-esignet-sunbird-setup.sh | 27 ++ docs/HELMSMAN_TESTRIGS_GUIDE.md | 59 +++- 10 files changed, 441 insertions(+), 198 deletions(-) create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-mosipid-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-setup.sh create mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-sunbird-setup.sh diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index cdd80f7f9..5e518fcf5 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -124,6 +124,29 @@ jobs: env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} slack_channel_name: ${{ github.event.inputs.slack_channel_name || vars.SLACK_CHANNEL_NAME }} SLACK_WEBHOOK_URL: ${{ github.event.inputs.slack_webhook_url || secrets.SLACK_WEBHOOK_URL }} + # esignet-standalone-2.0.0 only — esignet-apitestrig/esignet-uitestrig (the Go/Java + # rewrite testrig charts, replacing the generic apitestrig/uitestrig charts for this + # profile). Reused across all 3 instances (mock/mosipid/sunbird), same as + # mock-relying-party-service's own CLIENT_ID constant in esignet-dsf.yaml. + ESIGNET_UITESTRIG_OIDC_CLIENT_ID: ${{ vars.ESIGNET_UITESTRIG_OIDC_CLIENT_ID }} + ESIGNET_UITESTRIG_CLIENT_SECRET: ${{ secrets.ESIGNET_UITESTRIG_CLIENT_SECRET }} + # Single shared Keycloak admin password (one mosip/keycloak release for the whole + # profile — see external-dsf.yaml) — already provisioned for the MISP onboarder. + MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD }} + # esignet-mosipid apitestrig/uitestrig only — config.mosip.json (apitestrig) and the + # MOSIP-ID plugin path (uitestrig) are the only ones backed by a real IDA identity, so + # these are the only instance that needs real test-identity/onboarding values. esignet-mock + # (config.mock.json) and esignet-sunbird (config.sunbird.json) need none of this. + MOSIPID_TESTRIG_INDIVIDUAL_ID: ${{ secrets.MOSIPID_TESTRIG_INDIVIDUAL_ID }} + MOSIPID_TESTRIG_OTP_RECIPIENT: ${{ secrets.MOSIPID_TESTRIG_OTP_RECIPIENT }} + MOSIPID_TESTRIG_AUTH_PARTNER_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_PARTNER_ID }} + MOSIPID_TESTRIG_AUTH_POLICY_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_POLICY_ID }} + MOSIPID_TESTRIG_UIN: ${{ secrets.MOSIPID_TESTRIG_UIN }} + MOSIPID_TESTRIG_VID: ${{ secrets.MOSIPID_TESTRIG_VID }} + MOSIPID_TESTRIG_PHONE_NUMBER: ${{ secrets.MOSIPID_TESTRIG_PHONE_NUMBER }} + MOSIPID_TESTRIG_EMAIL_LOGIN_ID: ${{ secrets.MOSIPID_TESTRIG_EMAIL_LOGIN_ID }} + MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN: ${{ secrets.MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN }} + MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD: ${{ secrets.MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD }} steps: - name: Checkout repository uses: actions/checkout@v4 @@ -295,6 +318,67 @@ jobs: echo "❌ secret minio not found in minio namespace"; exit 1 fi + - name: Validate esignet-standalone-2.0.0 testrig secrets + if: env.PROFILE == 'esignet-standalone-2.0.0' + run: | + errors=() + [ -z "$ESIGNET_UITESTRIG_OIDC_CLIENT_ID" ] && errors+=("ESIGNET_UITESTRIG_OIDC_CLIENT_ID (vars)") + [ -z "$ESIGNET_UITESTRIG_CLIENT_SECRET" ] && errors+=("ESIGNET_UITESTRIG_CLIENT_SECRET (secrets)") + [ -z "$MOSIPID_KEYCLOAK_ADMIN_PASSWORD" ] && errors+=("MOSIPID_KEYCLOAK_ADMIN_PASSWORD (secrets)") + [ -z "$MOSIPID_TESTRIG_INDIVIDUAL_ID" ] && errors+=("MOSIPID_TESTRIG_INDIVIDUAL_ID (secrets)") + [ -z "$MOSIPID_TESTRIG_OTP_RECIPIENT" ] && errors+=("MOSIPID_TESTRIG_OTP_RECIPIENT (secrets)") + [ -z "$MOSIPID_TESTRIG_AUTH_PARTNER_ID" ] && errors+=("MOSIPID_TESTRIG_AUTH_PARTNER_ID (vars)") + [ -z "$MOSIPID_TESTRIG_AUTH_POLICY_ID" ] && errors+=("MOSIPID_TESTRIG_AUTH_POLICY_ID (vars)") + [ -z "$MOSIPID_TESTRIG_UIN" ] && errors+=("MOSIPID_TESTRIG_UIN (secrets)") + [ -z "$MOSIPID_TESTRIG_VID" ] && errors+=("MOSIPID_TESTRIG_VID (secrets)") + [ -z "$MOSIPID_TESTRIG_PHONE_NUMBER" ] && errors+=("MOSIPID_TESTRIG_PHONE_NUMBER (secrets)") + [ -z "$MOSIPID_TESTRIG_EMAIL_LOGIN_ID" ] && errors+=("MOSIPID_TESTRIG_EMAIL_LOGIN_ID (secrets)") + [ -z "$MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN" ] && errors+=("MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN (secrets)") + [ -z "$MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD" ] && errors+=("MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD (secrets)") + if [ ${#errors[@]} -gt 0 ]; then + echo "❌ Missing required Environment values for esignet-standalone-2.0.0 testrigs:" + printf ' - %s\n' "${errors[@]}" + echo "Go to: Settings → Environments → ${{ github.ref_name }} → Secrets/Variables" + exit 1 + fi + echo "✅ All esignet-standalone-2.0.0 testrig secrets/variables are configured" + + - name: Get PMS client secret (esignet-standalone-2.0.0 apitestrig) + if: env.PROFILE == 'esignet-standalone-2.0.0' + run: | + # esignet-apitestrig's KEYCLOAK_CLIENT_SECRET is the same mosip-pms-client secret + # esignet-preinstall-keycloak-init.sh/esignet-postinstall-keycloak-init.sh already use + # (PMS_CLIENT_SECRET_KEY='mosip_pms_client_secret') — by the time testrigs run, eSignet + # DSF has already completed, so keycloak-client-secrets is guaranteed to exist. + if ! kubectl -n keycloak get secret keycloak-client-secrets &>/dev/null; then + echo "❌ keycloak-client-secrets not found in keycloak namespace"; exit 1 + fi + PMS_CLIENT_SECRET_VALUE=$(kubectl -n keycloak get secret keycloak-client-secrets \ + -o jsonpath='{.data.mosip_pms_client_secret}' | base64 -d) + if [ -z "$PMS_CLIENT_SECRET_VALUE" ]; then + echo "❌ mosip_pms_client_secret is empty in keycloak-client-secrets"; exit 1 + fi + echo "::add-mask::$PMS_CLIENT_SECRET_VALUE" + echo "PMS_CLIENT_SECRET_VALUE=$PMS_CLIENT_SECRET_VALUE" >> $GITHUB_ENV + echo "✅ PMS_CLIENT_SECRET_VALUE retrieved" + + - name: Get consent DB password (esignet-standalone-2.0.0 uitestrig) + if: env.PROFILE == 'esignet-standalone-2.0.0' + run: | + # esignet-uitestrig's esignetDbPassword — same db-common-secrets/db-dbuser-password + # helmsman_esignet.yml's own "Get DB User Password" step already reads. + if ! kubectl -n postgres get secret db-common-secrets &>/dev/null; then + echo "❌ db-common-secrets not found in postgres namespace"; exit 1 + fi + DB_USER_PASSWORD=$(kubectl -n postgres get secret db-common-secrets \ + -o jsonpath='{.data.db-dbuser-password}' | base64 -d) + if [ -z "$DB_USER_PASSWORD" ]; then + echo "❌ db-dbuser-password is empty in db-common-secrets"; exit 1 + fi + echo "::add-mask::$DB_USER_PASSWORD" + echo "DB_USER_PASSWORD=$DB_USER_PASSWORD" >> $GITHUB_ENV + echo "✅ DB_USER_PASSWORD retrieved" + - name: Check if mosip-dsf label is completed if: ${{ !startsWith(env.PROFILE, 'esignet-standalone') }} run: | diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index a23036792..3808f73cc 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -1,3 +1,34 @@ +# ============================================================================= +# eSignet Standalone 2.0.0 Profile - Testrigs DSF (Desired State File) +# ============================================================================= +# eSignet's own apitestrig/uitestrig apps below deploy the dedicated Go/Java-harness +# charts mosip/esignet-apitestrig and mosip/esignet-uitestrig (v2.0.0) — NOT the +# generic mosip/apitestrig / mosip/uitestrig charts the esignet-standalone (1.0/Java) +# profile still uses. These charts are purpose-built for eSignet 2.0.0 (Go) and have +# a completely different values schema (no modules.*/configmaps.* — see each chart's +# own values.yaml via `helm show values mosip/esignet-apitestrig --version 2.0.0`). +# +# Modeled directly on eSignet's own reference deploy scripts: +# https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh +# https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh +# translated from "helm install with two interactive prompts + a gitignored +# values.secret.yaml" into this DSF's declarative set: blocks, with every value +# either derived from this profile's existing ${domain_name}/${mosipid_domain_name} +# conventions or sourced from a required GitHub Environment secret/variable (see +# docs/HELMSMAN_TESTRIGS_GUIDE.md). +# +# Only esignet-mosipid gets real test-identity/onboarding values (INDIVIDUAL_ID, +# OTP recipient, auth partner/policy ID, UIN/VID/etc.) — it's the only instance +# backed by a real IDA identity (config.mosip.json / the "mosip" plugin). esignet-mock +# (config.mock.json / "mock" plugin) and esignet-sunbird (config.sunbird.json / +# "sunbird" plugin) need none of that. +# +# Report storage: reports.persistence (PVC) is used instead of reports.s3 — the S3 +# path needs a pre-existing bucket this repo has no established convention for yet. +# Switch to reports.s3.enabled once one exists (reuse the ${MINIO_ROOT_PASSWORD} +# pattern from esignet-signup-apitestrig/signup-uitestrig below). +# ============================================================================= + helmDefaults: tillerNamespace: kube-system tillerless: true @@ -7,12 +38,11 @@ helmRepos: bitnami: https://charts.bitnami.com/bitnami mosip: https://mosip.github.io/mosip-helm -# Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): -# esignet-apitestrig → esignet-mock ns -# esignet-mosipid-apitestrig → esignet-mosipid ns -# esignet-sunbird-apitestrig → esignet-sunbird ns -# esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) -# signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) +# eSignet's own apitestrig deploys into the same namespace as the eSignet instance it +# tests (matches install.sh's own NS=esignet pattern, scaled to this profile's 3 +# instances). uitestrig gets its own namespace per instance, same as install.sh's +# NS=esignet-uitestrig (separate from esignet-apitestrig's namespace) and matching +# this DSF's existing signup-uitestrig precedent. namespaces: esignet-mock: protected: false @@ -20,6 +50,12 @@ namespaces: protected: false esignet-sunbird: protected: false + esignet-uitestrig: + protected: false + esignet-mosipid-uitestrig: + protected: false + esignet-sunbird-uitestrig: + protected: false signup: protected: false signup-uitestrig: @@ -27,147 +63,167 @@ namespaces: apps: # --------------------------------------------------------------------------- - # eSignet API Testrig — main esignet namespace + # eSignet API Testrig (Go harness) — esignet-mock namespace # --------------------------------------------------------------------------- esignet-apitestrig: namespace: esignet-mock enabled: true - version: 0.0.1-develop - chart: mosip/apitestrig - valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" + version: 2.0.0 + chart: mosip/esignet-apitestrig set: - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "s3" - extraEnvVarsCM[2]: "keycloak-host" - extraEnvVarsCM[3]: "db" - extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-apitestrig" - extraEnvVarsSecret[2]: "keycloak-client-secrets" - extraEnvVarsSecret[3]: "postgres-postgresql" - crontime: "0 2 * * *" - apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' - apitestrig.configmaps.s3.s3-user-key: 'admin' - apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${domain_name}" - apitestrig.configmaps.db.db-su-user: "postgres" - apitestrig.configmaps.db.db-port: "${esignet_db_port}" - apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" - apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" - apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" - apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" - apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" - apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mock" - apitestrig.configmaps.apitestrig.servicesNotDeployed: '' - apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet.${domain_name}" - apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - apitestrig.variables.push_reports_to_s3: "yes" - priority: -5 + apitestrig.configFile: /app/data/config/config.mock.json + # No plan JSON files provisioned for this profile — see header comment. + apitestrig.surfaces: "api,e2e" + apitestrig.extraEnvVars.MOSIP_ESIGNET_BASE_URL: "https://esignet.${domain_name}/v1/esignet" + apitestrig.extraEnvVars.KEYCLOAK_TOKEN_URL: "https://iam.${domain_name}/auth/realms/mosip/protocol/openid-connect/token" + apitestrig.extraEnvVars.KEYCLOAK_CLIENT_ID: "mosip-pms-client" + apitestrig.extraEnvVarsSecret.KEYCLOAK_CLIENT_SECRET: "${PMS_CLIENT_SECRET_VALUE}" + reports.persistence.enabled: "true" + timeout: 900 + priority: -8 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh" # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid namespace (mosip-identity-plugin) + # eSignet-MOSIPID API Testrig (Go harness) — esignet-mosipid namespace + # Only instance with real test-identity/onboarding values — see header comment. # --------------------------------------------------------------------------- esignet-mosipid-apitestrig: namespace: esignet-mosipid enabled: true - version: 0.0.1-develop - chart: mosip/apitestrig - valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" + version: 2.0.0 + chart: mosip/esignet-apitestrig set: - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "s3" - extraEnvVarsCM[2]: "keycloak-host" - extraEnvVarsCM[3]: "db" - extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid-apitestrig" - extraEnvVarsSecret[2]: "keycloak-client-secrets" - extraEnvVarsSecret[3]: "postgres-postgresql" - crontime: "0 2 * * *" - apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' - apitestrig.configmaps.s3.s3-user-key: 'admin' - apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid_domain_name}" - apitestrig.configmaps.db.db-su-user: "postgres" - apitestrig.configmaps.db.db-port: "${esignet_db_port}" - apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" - apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" - apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" - apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" - apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" - apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid" - apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' - apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" - apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" - secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - apitestrig.variables.push_reports_to_s3: "yes" - priority: -3 + apitestrig.configFile: /app/data/config/config.mosip.json + apitestrig.surfaces: "api,e2e" + apitestrig.extraEnvVars.MOSIP_ESIGNET_BASE_URL: "https://esignet-mosipid.${domain_name}/v1/esignet" + apitestrig.extraEnvVars.KEYCLOAK_TOKEN_URL: "https://iam.${domain_name}/auth/realms/mosip/protocol/openid-connect/token" + apitestrig.extraEnvVars.KEYCLOAK_CLIENT_ID: "mosip-pms-client" + apitestrig.extraEnvVars.ID_TYPE: "uin" + apitestrig.extraEnvVars.OTP_WS_URL: "https://smtp.${domain_name}" + apitestrig.extraEnvVars.OTP_RECIPIENT_EMAIL: "${MOSIPID_TESTRIG_OTP_RECIPIENT}" + apitestrig.extraEnvVars.PMS_BASE_URL: "https://api-internal.${mosipid_domain_name}/v1/partnermanager" + apitestrig.extraEnvVars.AUTH_PARTNER_ID: "${MOSIPID_TESTRIG_AUTH_PARTNER_ID}" + apitestrig.extraEnvVars.AUTH_POLICY_ID: "${MOSIPID_TESTRIG_AUTH_POLICY_ID}" + apitestrig.extraEnvVarsSecret.KEYCLOAK_CLIENT_SECRET: "${PMS_CLIENT_SECRET_VALUE}" + apitestrig.extraEnvVarsSecret.INDIVIDUAL_ID: "${MOSIPID_TESTRIG_INDIVIDUAL_ID}" + reports.persistence.enabled: "true" + timeout: 900 + priority: -7 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh" # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-sunbird namespace (sunbird-rc-plugin) - # postInstall triggers all four testrig namespaces after last one deploys. + # eSignet-Sunbird API Testrig (Go harness) — esignet-sunbird namespace # --------------------------------------------------------------------------- esignet-sunbird-apitestrig: namespace: esignet-sunbird enabled: true - version: 0.0.1-develop - chart: mosip/apitestrig - valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" + version: 2.0.0 + chart: mosip/esignet-apitestrig set: - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "s3" - extraEnvVarsCM[2]: "keycloak-host" - extraEnvVarsCM[3]: "db" - extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-sunbird-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-sunbird-apitestrig" - extraEnvVarsSecret[2]: "keycloak-client-secrets" - extraEnvVarsSecret[3]: "postgres-postgresql" - crontime: "0 2 * * *" - apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' - apitestrig.configmaps.s3.s3-user-key: 'admin' - apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${domain_name}" - apitestrig.configmaps.db.db-su-user: "postgres" - apitestrig.configmaps.db.db-port: "${esignet_db_port}" - apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" - apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" - apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" - apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" - apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" - apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-sunbird" - apitestrig.configmaps.apitestrig.servicesNotDeployed: '' - apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-sunbird.${domain_name}" - apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid_domain_name}" - secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - apitestrig.variables.push_reports_to_s3: "yes" - priority: -2 + apitestrig.configFile: /app/data/config/config.sunbird.json + apitestrig.surfaces: "api,e2e" + apitestrig.extraEnvVars.MOSIP_ESIGNET_BASE_URL: "https://esignet-sunbird.${domain_name}/v1/esignet" + apitestrig.extraEnvVars.KEYCLOAK_TOKEN_URL: "https://iam.${domain_name}/auth/realms/mosip/protocol/openid-connect/token" + apitestrig.extraEnvVars.KEYCLOAK_CLIENT_ID: "mosip-pms-client" + apitestrig.extraEnvVarsSecret.KEYCLOAK_CLIENT_SECRET: "${PMS_CLIENT_SECRET_VALUE}" + reports.persistence.enabled: "true" + timeout: 900 + priority: -6 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh" - # postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh" + + # --------------------------------------------------------------------------- + # eSignet UI Testrig (Java harness, uitest-esignet image) — own namespace + # --------------------------------------------------------------------------- + esignet-uitestrig: + namespace: esignet-uitestrig + enabled: true + version: 2.0.0 + chart: mosip/esignet-uitestrig + set: + uitestrig.extraEnvVars.ENV_ENDPOINT: "https://api-internal.${domain_name}" + uitestrig.extraEnvVars.ENV_USER: "api-internal.${env_name}" + uitestrig.configMap.baseurl: "https://healthservices.${domain_name}/" + uitestrig.configMap.eSignetbaseurl: "https://esignet.${domain_name}" + uitestrig.configMap.pluginToExecute: "mock" + uitestrig.configMap.esignetDbHost: "postgres-postgresql.postgres" + uitestrig.configMap.esignetDbPort: "${esignet_db_port}" + uitestrig.secret.esignetDbPassword: "${DB_USER_PASSWORD}" + uitestrig.secret.keycloak_Password: "${MOSIPID_KEYCLOAK_ADMIN_PASSWORD}" + uitestrig.secret.mosip_testrig_client_secret: "${ESIGNET_UITESTRIG_CLIENT_SECRET}" + uitestrig.secret.oidcClientId: "${ESIGNET_UITESTRIG_OIDC_CLIENT_ID}" + reports.persistence.enabled: "true" + timeout: 1800 + priority: -5 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/uitestrig-esignet-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet-MOSIPID UI Testrig — own namespace + # Only instance with real test-identity values — see header comment. + # --------------------------------------------------------------------------- + esignet-mosipid-uitestrig: + namespace: esignet-mosipid-uitestrig + enabled: true + version: 2.0.0 + chart: mosip/esignet-uitestrig + set: + uitestrig.extraEnvVars.ENV_ENDPOINT: "https://api-internal.${mosipid_domain_name}" + uitestrig.extraEnvVars.ENV_USER: "api-internal.${env_name}" + uitestrig.configMap.baseurl: "https://healthservices-mosipid.${domain_name}/" + uitestrig.configMap.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" + uitestrig.configMap.pluginToExecute: "mosip" + uitestrig.configMap.esignetDbHost: "postgres-postgresql.postgres" + uitestrig.configMap.esignetDbPort: "${esignet_db_port}" + uitestrig.secret.esignetDbPassword: "${DB_USER_PASSWORD}" + uitestrig.secret.keycloak_Password: "${MOSIPID_KEYCLOAK_ADMIN_PASSWORD}" + uitestrig.secret.mosip_testrig_client_secret: "${ESIGNET_UITESTRIG_CLIENT_SECRET}" + uitestrig.secret.oidcClientId: "${ESIGNET_UITESTRIG_OIDC_CLIENT_ID}" + uitestrig.secret.uin: "${MOSIPID_TESTRIG_UIN}" + uitestrig.secret.vid: "${MOSIPID_TESTRIG_VID}" + uitestrig.secret.uinPhoneNumber: "${MOSIPID_TESTRIG_PHONE_NUMBER}" + uitestrig.secret.emailLoginId: "${MOSIPID_TESTRIG_EMAIL_LOGIN_ID}" + uitestrig.secret.passwordLoginUin: "${MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN}" + uitestrig.secret.passwordLoginPassword: "${MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD}" + reports.persistence.enabled: "true" + timeout: 1800 + priority: -4 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/uitestrig-esignet-mosipid-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet-Sunbird UI Testrig — own namespace + # --------------------------------------------------------------------------- + esignet-sunbird-uitestrig: + namespace: esignet-sunbird-uitestrig + enabled: true + version: 2.0.0 + chart: mosip/esignet-uitestrig + set: + uitestrig.extraEnvVars.ENV_ENDPOINT: "https://api-internal.${domain_name}" + uitestrig.extraEnvVars.ENV_USER: "api-internal.${env_name}" + uitestrig.configMap.baseurl: "https://healthservices-sunbird.${domain_name}/" + uitestrig.configMap.eSignetbaseurl: "https://esignet-sunbird.${domain_name}" + uitestrig.configMap.pluginToExecute: "sunbird" + uitestrig.configMap.esignetDbHost: "postgres-postgresql.postgres" + uitestrig.configMap.esignetDbPort: "${esignet_db_port}" + uitestrig.secret.esignetDbPassword: "${DB_USER_PASSWORD}" + uitestrig.secret.keycloak_Password: "${MOSIPID_KEYCLOAK_ADMIN_PASSWORD}" + uitestrig.secret.mosip_testrig_client_secret: "${ESIGNET_UITESTRIG_CLIENT_SECRET}" + uitestrig.secret.oidcClientId: "${ESIGNET_UITESTRIG_OIDC_CLIENT_ID}" + reports.persistence.enabled: "true" + timeout: 1800 + priority: -3 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/uitestrig-esignet-sunbird-setup.sh" # --------------------------------------------------------------------------- # Signup API Test Rig — disabled by default - # Enable only if signup stack (signup-dsf) is deployed. + # Enable only if signup stack (signup-dsf) is deployed. Still the generic + # mosip/apitestrig chart — eSignet's own esignet-apitestrig deploy scripts don't + # cover signup. # --------------------------------------------------------------------------- esignet-signup-apitestrig: namespace: signup diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh index 085a41dfb..8b582384a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh @@ -2,38 +2,26 @@ # ============================================================================= # eSignet Standalone 2.0.0 - eSignet-MOSIPID API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid namespace for the esignet-mosipid-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid -# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, -# and the s3-esignet-mosipid-apitestrig / apitestrig-esignet-mosipid-apitestrig -# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create -# them itself); stale testrig CMs are deleted so the chart recreates them. +# esignet-mosipid-apitestrig now deploys the dedicated mosip/esignet-apitestrig chart +# (the Go-harness rewrite - see https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh), +# which manages its own Secret/ConfigMap from set: values directly - no pre-staged +# secrets needed, unlike the old generic mosip/apitestrig chart this replaces. +# +# The only job left here: delete the unmanaged s3/db/apitestrig ConfigMaps and the +# s3-esignet-mosipid-apitestrig/apitestrig-esignet-mosipid-apitestrig Secrets the OLD +# chart's own preInstall hook used to create directly via kubectl (Helm never owned +# them, so switching charts under the same release name won't clean them up on its own). # ============================================================================= set -euo pipefail NS=esignet-mosipid -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID API Testrig Pre-install" echo "================================================" -echo "Deleting stale testrig configmaps in $NS" -kubectl -n "$NS" delete --ignore-not-found=true configmap s3 -kubectl -n "$NS" delete --ignore-not-found=true configmap db -kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig - -echo "Creating s3-esignet-mosipid-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic s3-esignet-mosipid-apitestrig \ - --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Creating apitestrig-esignet-mosipid-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid-apitestrig \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying postgres-postgresql secret to $NS" -$COPY_UTIL secret postgres-postgresql postgres "$NS" +echo "Deleting stale testrig resources from the old mosip/apitestrig-based release in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 db apitestrig +kubectl -n "$NS" delete --ignore-not-found=true secret s3-esignet-mosipid-apitestrig apitestrig-esignet-mosipid-apitestrig echo "eSignet-MOSIPID API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh index b44bfdeae..3dfe1e529 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh @@ -2,38 +2,26 @@ # ============================================================================= # eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mock namespace for the esignet-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mock ns -# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, -# and the s3-esignet-apitestrig / apitestrig-esignet-apitestrig secrets referenced -# by extraEnvVarsSecret are created here (chart doesn't create them itself); stale -# testrig CMs are deleted so the chart recreates them. +# esignet-apitestrig now deploys the dedicated mosip/esignet-apitestrig chart (the +# Go-harness rewrite - see https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh), +# which manages its own Secret/ConfigMap from set: values directly - no pre-staged +# secrets needed, unlike the old generic mosip/apitestrig chart this replaces. +# +# The only job left here: delete the unmanaged s3/db/apitestrig ConfigMaps and the +# s3-esignet-apitestrig/apitestrig-esignet-apitestrig Secrets the OLD chart's own +# preInstall hook used to create directly via kubectl (Helm never owned them, so +# switching charts under the same release name won't clean them up on its own). # ============================================================================= set -euo pipefail NS=esignet-mock -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" echo "eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install" echo "================================================" -echo "Deleting stale testrig configmaps in $NS" -kubectl -n "$NS" delete --ignore-not-found=true configmap s3 -kubectl -n "$NS" delete --ignore-not-found=true configmap db -kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig - -echo "Creating s3-esignet-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic s3-esignet-apitestrig \ - --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Creating apitestrig-esignet-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic apitestrig-esignet-apitestrig \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying postgres-postgresql secret to $NS" -$COPY_UTIL secret postgres-postgresql postgres "$NS" +echo "Deleting stale testrig resources from the old mosip/apitestrig-based release in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 db apitestrig +kubectl -n "$NS" delete --ignore-not-found=true secret s3-esignet-apitestrig apitestrig-esignet-apitestrig echo "eSignet API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh index ca432b01c..50635219b 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh @@ -2,38 +2,26 @@ # ============================================================================= # eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-sunbird namespace for the esignet-sunbird-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-sunbird -# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, -# and the s3-esignet-sunbird-apitestrig / apitestrig-esignet-sunbird-apitestrig -# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create -# them itself); stale testrig CMs are deleted so the chart recreates them. +# esignet-sunbird-apitestrig now deploys the dedicated mosip/esignet-apitestrig chart +# (the Go-harness rewrite - see https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh), +# which manages its own Secret/ConfigMap from set: values directly - no pre-staged +# secrets needed, unlike the old generic mosip/apitestrig chart this replaces. +# +# The only job left here: delete the unmanaged s3/db/apitestrig ConfigMaps and the +# s3-esignet-sunbird-apitestrig/apitestrig-esignet-sunbird-apitestrig Secrets the OLD +# chart's own preInstall hook used to create directly via kubectl (Helm never owned +# them, so switching charts under the same release name won't clean them up on its own). # ============================================================================= set -euo pipefail NS=esignet-sunbird -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" echo "eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install" echo "================================================" -echo "Deleting stale testrig configmaps in $NS" -kubectl -n "$NS" delete --ignore-not-found=true configmap s3 -kubectl -n "$NS" delete --ignore-not-found=true configmap db -kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig - -echo "Creating s3-esignet-sunbird-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic s3-esignet-sunbird-apitestrig \ - --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Creating apitestrig-esignet-sunbird-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic apitestrig-esignet-sunbird-apitestrig \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying postgres-postgresql secret to $NS" -$COPY_UTIL secret postgres-postgresql postgres "$NS" +echo "Deleting stale testrig resources from the old mosip/apitestrig-based release in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 db apitestrig +kubectl -n "$NS" delete --ignore-not-found=true secret s3-esignet-sunbird-apitestrig apitestrig-esignet-sunbird-apitestrig echo "eSignet-Sunbird API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh index 1b31cbfee..ed2f4a274 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh @@ -3,7 +3,9 @@ # eSignet Standalone 2.0.0 - Trigger Testrig CronJobs # ============================================================================= # Immediately triggers testrig CronJobs after deployment: -# apitestrig → esignet-mock ns +# apitestrig → esignet-mock / esignet-mosipid / esignet-sunbird ns +# uitestrig → esignet-uitestrig / esignet-mosipid-uitestrig / +# esignet-sunbird-uitestrig ns # signup-apitestrig → signup ns (if deployed) # signup-uitestrig → signup-uitestrig ns (if deployed) # ============================================================================= @@ -120,6 +122,15 @@ trigger_all_in_ns esignet-mosipid || OVERALL_SUCCESS=false echo "=== eSignet-Sunbird API Testrig (esignet-sunbird ns) ===" trigger_all_in_ns esignet-sunbird || OVERALL_SUCCESS=false +echo "=== eSignet UI Testrig (esignet-uitestrig ns) ===" +trigger_all_in_ns esignet-uitestrig || OVERALL_SUCCESS=false + +echo "=== eSignet-MOSIPID UI Testrig (esignet-mosipid-uitestrig ns) ===" +trigger_all_in_ns esignet-mosipid-uitestrig || OVERALL_SUCCESS=false + +echo "=== eSignet-Sunbird UI Testrig (esignet-sunbird-uitestrig ns) ===" +trigger_all_in_ns esignet-sunbird-uitestrig || OVERALL_SUCCESS=false + echo "=== Signup API Testrig (signup ns, if deployed) ===" trigger_all_in_ns signup || OVERALL_SUCCESS=false diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-mosipid-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-mosipid-setup.sh new file mode 100755 index 000000000..f5feaff8d --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-mosipid-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - eSignet-MOSIPID UI Testrig Pre-install Setup +# ============================================================================= +# esignet-mosipid-uitestrig deploys the dedicated mosip/esignet-uitestrig chart (the +# Java-harness rewrite for eSignet 2.0.0 - see +# https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh), +# into its own esignet-mosipid-uitestrig namespace, separate from eSignet's own +# esignet-mosipid namespace (matches install.sh's own NS/SOURCE_NS split). +# +# The chart manages its own ConfigMap/Secret entirely from set: values - no +# pre-staged secrets needed. The only job here is namespace bootstrap, same as +# uitestrig-signup-setup.sh's existing pattern for signup-uitestrig. +# ============================================================================= +set -euo pipefail + +NS=esignet-mosipid-uitestrig + +echo "================================================" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID UI Testrig Pre-install" +echo "================================================" + +echo "Ensuring $NS namespace exists with Istio injection disabled" +kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$NS" istio-injection=disabled --overwrite + +echo "eSignet-MOSIPID UI Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-setup.sh new file mode 100755 index 000000000..cbcf5d505 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - eSignet UI Testrig Pre-install Setup +# ============================================================================= +# esignet-uitestrig deploys the dedicated mosip/esignet-uitestrig chart (the +# Java-harness rewrite for eSignet 2.0.0 - see +# https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh), +# into its own esignet-uitestrig namespace, separate from eSignet's own esignet-mock +# namespace (matches install.sh's own NS=esignet-uitestrig / SOURCE_NS=esignet split). +# +# The chart manages its own ConfigMap/Secret entirely from set: values - no +# pre-staged secrets needed. The only job here is namespace bootstrap, same as +# uitestrig-signup-setup.sh's existing pattern for signup-uitestrig. +# ============================================================================= +set -euo pipefail + +NS=esignet-uitestrig + +echo "================================================" +echo "eSignet Standalone 2.0.0 - eSignet UI Testrig Pre-install" +echo "================================================" + +echo "Ensuring $NS namespace exists with Istio injection disabled" +kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$NS" istio-injection=disabled --overwrite + +echo "eSignet UI Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-sunbird-setup.sh new file mode 100755 index 000000000..fda37f698 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-sunbird-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - eSignet-Sunbird UI Testrig Pre-install Setup +# ============================================================================= +# esignet-sunbird-uitestrig deploys the dedicated mosip/esignet-uitestrig chart (the +# Java-harness rewrite for eSignet 2.0.0 - see +# https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh), +# into its own esignet-sunbird-uitestrig namespace, separate from eSignet's own +# esignet-sunbird namespace (matches install.sh's own NS/SOURCE_NS split). +# +# The chart manages its own ConfigMap/Secret entirely from set: values - no +# pre-staged secrets needed. The only job here is namespace bootstrap, same as +# uitestrig-signup-setup.sh's existing pattern for signup-uitestrig. +# ============================================================================= +set -euo pipefail + +NS=esignet-sunbird-uitestrig + +echo "================================================" +echo "eSignet Standalone 2.0.0 - eSignet-Sunbird UI Testrig Pre-install" +echo "================================================" + +echo "Ensuring $NS namespace exists with Istio injection disabled" +kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$NS" istio-injection=disabled --overwrite + +echo "eSignet-Sunbird UI Testrig pre-install setup completed." diff --git a/docs/HELMSMAN_TESTRIGS_GUIDE.md b/docs/HELMSMAN_TESTRIGS_GUIDE.md index 26660a709..89ced39a0 100644 --- a/docs/HELMSMAN_TESTRIGS_GUIDE.md +++ b/docs/HELMSMAN_TESTRIGS_GUIDE.md @@ -6,7 +6,7 @@ Deploy API, UI, and DSL test rigs after all services are running and partner onb **Workflow:** `helmsman_testrigs.yml` **DSF:** `Helmsman/dsf//testrigs-dsf.yaml` -**Time required:** 10–20 minutes +**Time required:** 10–20 minutes (`esignet-standalone-2.0.0`: up to ~45 minutes — its 3 UI testrigs each run headless Chrome + a JVM, which is slower than the API-only rigs) --- @@ -14,14 +14,16 @@ Deploy API, UI, and DSL test rigs after all services are running and partner onb | Profile | What deploys | Namespaces | |---------|-------------|------------| -| `esignet-standalone` | `esignet-apitestrig` into 3 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid`, `esignet-sunbird`, `signup` | -| `esignet-standalone-2.0.0` | Identical to `esignet-standalone` (Go rewrite) | Same namespaces as above | +| `esignet-standalone` | Generic `mosip/apitestrig`/`mosip/uitestrig` charts: `esignet-apitestrig` into 3 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid`, `esignet-sunbird`, `signup` | +| `esignet-standalone-2.0.0` | eSignet's own dedicated `mosip/esignet-apitestrig` (Go harness) + `mosip/esignet-uitestrig` (Java harness) charts — see note below; plus the same optional signup apitestrig/uitestrig as `esignet-standalone` | `esignet-mock`, `esignet-mosipid`, `esignet-sunbird`, `esignet-uitestrig`, `esignet-mosipid-uitestrig`, `esignet-sunbird-uitestrig`, `signup` | | `mosip-platform-1.2.0.x` | API testrig, UI testrig, DSL testrig | MOSIP testrig namespaces | | `mosip-platform-1.2.1.x` | Same as above | MOSIP testrig namespaces | > **eSignet standalone (`esignet-standalone` / `esignet-standalone-2.0.0` profiles):** Requires `mosipid_domain_name` for the MOSIP-ID apitestrig endpoint. > -> **`esignet-standalone-2.0.0` note:** `testrigs-dsf.yaml` deploys the exact same apps into the exact same namespaces as `esignet-standalone` — only the hook scripts differ (`hooks/esignet-standalone-2.0.0/` instead of `hooks/esignet-standalone/`). +> **`esignet-standalone-2.0.0` note:** Unlike the profile-differences doc gap this used to have, `testrigs-dsf.yaml` here does **not** deploy the same apps as `esignet-standalone` — it deploys eSignet's own reference testrig charts instead, modeled directly on +> [`esignet-apitestrig/install.sh`](https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh) and +> [`esignet-uitestrig/install.sh`](https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh). Each eSignet instance's apitestrig lives in that instance's own namespace (matching install.sh's `NS=esignet` pattern); each uitestrig gets its **own** namespace, separate from the eSignet instance it tests (matching install.sh's `NS=esignet-uitestrig` / `SOURCE_NS=esignet` split) — see [Required Secrets](#required-secrets) below for the extra values this needs. Only `esignet-mosipid` (the only instance backed by a real IDA identity) needs real test-identity values; `esignet-mock` and `esignet-sunbird` don't. --- @@ -49,10 +51,45 @@ All secrets are **Environment Secrets** — configure at **Repository → Settin | `CLUSTER_WIREGUARD_WG0` | WireGuard VPN config for cluster access | | `SLACK_WEBHOOK_URL` | Slack incoming webhook URL (optional — for test result notifications) | -### eSignet standalone profile only +### `esignet-standalone` profile only No additional secrets required for testrigs — captcha and keycloak secrets were already created during eSignet deployment and are available in each namespace. +### `esignet-standalone-2.0.0` profile only + +`esignet-apitestrig`/`esignet-uitestrig` (eSignet's own reference charts) need a few values the generic testrig charts didn't. Some are read live from the cluster (no setup needed); the rest must be configured as **Environment Secrets/Variables**: + +**Read automatically from the cluster** (already provisioned by eSignet's own deployment — nothing to add): + +| Value | Source | +|-------|--------| +| `KEYCLOAK_CLIENT_SECRET` (apitestrig, all 3 instances) | `keycloak-client-secrets` secret in the `keycloak` namespace — the same `mosip_pms_client_secret` key `esignet-preinstall-keycloak-init.sh` already uses | +| `esignetDbPassword` (uitestrig, all 3 instances) | `db-common-secrets` secret in the `postgres` namespace | + +**Required Environment Secrets/Variables** (Settings → Environments → ``): + +| Secret/Variable | Type | Used by | Description | +|---|---|---|---| +| `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` | Secret | uitestrig, all 3 instances | Reuses the same Keycloak admin password `esignet-misp-onboarder-mosipid-preinstall.sh` already needs — one shared `mosip/keycloak` release for the whole profile | +| `ESIGNET_UITESTRIG_OIDC_CLIENT_ID` | Variable | uitestrig, all 3 instances | Pre-provisioned OIDC client ID for browser login testing (reused across instances, same pattern as `mock-relying-party-service`'s shared `CLIENT_ID` in `esignet-dsf.yaml`) | +| `ESIGNET_UITESTRIG_CLIENT_SECRET` | Secret | uitestrig, all 3 instances | Secret for the client above | +| `MOSIPID_TESTRIG_INDIVIDUAL_ID` | Secret | apitestrig, `esignet-mosipid` only | Real IDA test identity (UIN) — PII | +| `MOSIPID_TESTRIG_OTP_RECIPIENT` | Secret | apitestrig, `esignet-mosipid` only | Phone/email that receives the test OTP | +| `MOSIPID_TESTRIG_AUTH_PARTNER_ID` | Variable | apitestrig, `esignet-mosipid` only | Auth partner ID used to build the test client ID | +| `MOSIPID_TESTRIG_AUTH_POLICY_ID` | Variable | apitestrig, `esignet-mosipid` only | Policy ID used to build the test client ID | +| `MOSIPID_TESTRIG_UIN` | Secret | uitestrig, `esignet-mosipid` only | Test UIN — PII | +| `MOSIPID_TESTRIG_VID` | Secret | uitestrig, `esignet-mosipid` only | Test VID — PII | +| `MOSIPID_TESTRIG_PHONE_NUMBER` | Secret | uitestrig, `esignet-mosipid` only | Test UIN's phone number — PII | +| `MOSIPID_TESTRIG_EMAIL_LOGIN_ID` | Secret | uitestrig, `esignet-mosipid` only | Test identity for email-OTP login scenarios | +| `MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN` | Secret | uitestrig, `esignet-mosipid` only | Test identity for password-login scenarios | +| `MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD` | Secret | uitestrig, `esignet-mosipid` only | Password for the identity above | + +Only `esignet-mosipid` needs real test-identity/onboarding values — it's the only instance backed by a real IDA identity (`config.mosip.json`/the `mosip` plugin). `esignet-mock` (`config.mock.json`/`mock` plugin) and `esignet-sunbird` (`config.sunbird.json`/`sunbird` plugin) need none of the `MOSIPID_TESTRIG_*` values above. + +The workflow's own "Validate esignet-standalone-2.0.0 testrig secrets" step fails clearly, listing exactly which of these are missing, before it tries to deploy. + +Report storage uses a PVC (`reports.persistence.enabled: true`), not S3 — there's no established MinIO bucket convention for these charts yet in this repo. Switch to `reports.s3.*` once one exists. + ### MOSIP platform profiles only No additional secrets required — MinIO root password is read automatically from the `minio` secret in the `minio` namespace (`kubectl -n minio get secret minio`). @@ -126,6 +163,11 @@ kubectl get cronjobs -n dslrig kubectl get cronjobs -n esignet kubectl get cronjobs -n esignet-mosipid kubectl get cronjobs -n esignet-sunbird + +# esignet-standalone-2.0.0 only — separate uitestrig namespaces +kubectl get cronjobs -n esignet-uitestrig +kubectl get cronjobs -n esignet-mosipid-uitestrig +kubectl get cronjobs -n esignet-sunbird-uitestrig ``` **2. Trigger DSL orchestrator (MOSIP platform profiles)** @@ -166,9 +208,14 @@ kubectl get pods -n apitestrig kubectl get pods -n uitestrig kubectl get pods -n dslrig -# Check testrig pods (eSignet standalone — same namespaces for esignet-standalone-2.0.0) +# Check testrig pods (eSignet standalone apitestrig — same namespaces for esignet-standalone-2.0.0) kubectl get pods -n esignet # esignet-apitestrig cronjob kubectl get pods -n esignet-mosipid kubectl get pods -n esignet-sunbird kubectl get pods -n signup # signup-apitestrig (if enabled) + +# esignet-standalone-2.0.0 only — separate uitestrig namespaces +kubectl get pods -n esignet-uitestrig +kubectl get pods -n esignet-mosipid-uitestrig +kubectl get pods -n esignet-sunbird-uitestrig ``` From 2c1074516dbfa2cc6b68d7fb0ad291dc56dd539a Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 24 Sep 2026 18:02:41 +0530 Subject: [PATCH 123/127] esignet-standalone-2.0.0 testrigs: only passwords/client secrets as GH Secrets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 10 of the 13 new esignet-standalone-2.0.0 testrig values were GitHub Secrets even though most are just IDs or test identities (UIN/VID/phone/email), not actual credentials. Demote everything except the three that are genuinely a password or client secret down to plain Environment Variables: stays a Secret: MOSIPID_KEYCLOAK_ADMIN_PASSWORD ESIGNET_UITESTRIG_CLIENT_SECRET MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD now a Variable: MOSIPID_TESTRIG_INDIVIDUAL_ID MOSIPID_TESTRIG_OTP_RECIPIENT MOSIPID_TESTRIG_UIN MOSIPID_TESTRIG_VID MOSIPID_TESTRIG_PHONE_NUMBER MOSIPID_TESTRIG_EMAIL_LOGIN_ID MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN (AUTH_PARTNER_ID/AUTH_POLICY_ID/OIDC_CLIENT_ID were already Variables) Updates helmsman_testrigs.yml's job env: block and validation-step labels, plus the Required Environment Secrets/Variables table in docs/HELMSMAN_TESTRIGS_GUIDE.md. testrigs-dsf.yaml itself needs no change — it references these by name only, not by whether GitHub classifies them as a secret or a variable. Signed-off-by: bhumi46 Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS --- .github/workflows/helmsman_testrigs.yml | 32 +++++++++++++------------ docs/HELMSMAN_TESTRIGS_GUIDE.md | 18 +++++++------- 2 files changed, 27 insertions(+), 23 deletions(-) diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 5e518fcf5..7bbc0d8d3 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -128,6 +128,8 @@ jobs: # rewrite testrig charts, replacing the generic apitestrig/uitestrig charts for this # profile). Reused across all 3 instances (mock/mosipid/sunbird), same as # mock-relying-party-service's own CLIENT_ID constant in esignet-dsf.yaml. + # Only actual credentials (passwords/client secrets) are GitHub Secrets below — + # everything else (IDs, test identities) is a plain Environment Variable. ESIGNET_UITESTRIG_OIDC_CLIENT_ID: ${{ vars.ESIGNET_UITESTRIG_OIDC_CLIENT_ID }} ESIGNET_UITESTRIG_CLIENT_SECRET: ${{ secrets.ESIGNET_UITESTRIG_CLIENT_SECRET }} # Single shared Keycloak admin password (one mosip/keycloak release for the whole @@ -137,15 +139,15 @@ jobs: # MOSIP-ID plugin path (uitestrig) are the only ones backed by a real IDA identity, so # these are the only instance that needs real test-identity/onboarding values. esignet-mock # (config.mock.json) and esignet-sunbird (config.sunbird.json) need none of this. - MOSIPID_TESTRIG_INDIVIDUAL_ID: ${{ secrets.MOSIPID_TESTRIG_INDIVIDUAL_ID }} - MOSIPID_TESTRIG_OTP_RECIPIENT: ${{ secrets.MOSIPID_TESTRIG_OTP_RECIPIENT }} + MOSIPID_TESTRIG_INDIVIDUAL_ID: ${{ vars.MOSIPID_TESTRIG_INDIVIDUAL_ID }} + MOSIPID_TESTRIG_OTP_RECIPIENT: ${{ vars.MOSIPID_TESTRIG_OTP_RECIPIENT }} MOSIPID_TESTRIG_AUTH_PARTNER_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_PARTNER_ID }} MOSIPID_TESTRIG_AUTH_POLICY_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_POLICY_ID }} - MOSIPID_TESTRIG_UIN: ${{ secrets.MOSIPID_TESTRIG_UIN }} - MOSIPID_TESTRIG_VID: ${{ secrets.MOSIPID_TESTRIG_VID }} - MOSIPID_TESTRIG_PHONE_NUMBER: ${{ secrets.MOSIPID_TESTRIG_PHONE_NUMBER }} - MOSIPID_TESTRIG_EMAIL_LOGIN_ID: ${{ secrets.MOSIPID_TESTRIG_EMAIL_LOGIN_ID }} - MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN: ${{ secrets.MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN }} + MOSIPID_TESTRIG_UIN: ${{ vars.MOSIPID_TESTRIG_UIN }} + MOSIPID_TESTRIG_VID: ${{ vars.MOSIPID_TESTRIG_VID }} + MOSIPID_TESTRIG_PHONE_NUMBER: ${{ vars.MOSIPID_TESTRIG_PHONE_NUMBER }} + MOSIPID_TESTRIG_EMAIL_LOGIN_ID: ${{ vars.MOSIPID_TESTRIG_EMAIL_LOGIN_ID }} + MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN: ${{ vars.MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN }} MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD: ${{ secrets.MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD }} steps: - name: Checkout repository @@ -318,22 +320,22 @@ jobs: echo "❌ secret minio not found in minio namespace"; exit 1 fi - - name: Validate esignet-standalone-2.0.0 testrig secrets + - name: Validate esignet-standalone-2.0.0 testrig secrets/variables if: env.PROFILE == 'esignet-standalone-2.0.0' run: | errors=() [ -z "$ESIGNET_UITESTRIG_OIDC_CLIENT_ID" ] && errors+=("ESIGNET_UITESTRIG_OIDC_CLIENT_ID (vars)") [ -z "$ESIGNET_UITESTRIG_CLIENT_SECRET" ] && errors+=("ESIGNET_UITESTRIG_CLIENT_SECRET (secrets)") [ -z "$MOSIPID_KEYCLOAK_ADMIN_PASSWORD" ] && errors+=("MOSIPID_KEYCLOAK_ADMIN_PASSWORD (secrets)") - [ -z "$MOSIPID_TESTRIG_INDIVIDUAL_ID" ] && errors+=("MOSIPID_TESTRIG_INDIVIDUAL_ID (secrets)") - [ -z "$MOSIPID_TESTRIG_OTP_RECIPIENT" ] && errors+=("MOSIPID_TESTRIG_OTP_RECIPIENT (secrets)") + [ -z "$MOSIPID_TESTRIG_INDIVIDUAL_ID" ] && errors+=("MOSIPID_TESTRIG_INDIVIDUAL_ID (vars)") + [ -z "$MOSIPID_TESTRIG_OTP_RECIPIENT" ] && errors+=("MOSIPID_TESTRIG_OTP_RECIPIENT (vars)") [ -z "$MOSIPID_TESTRIG_AUTH_PARTNER_ID" ] && errors+=("MOSIPID_TESTRIG_AUTH_PARTNER_ID (vars)") [ -z "$MOSIPID_TESTRIG_AUTH_POLICY_ID" ] && errors+=("MOSIPID_TESTRIG_AUTH_POLICY_ID (vars)") - [ -z "$MOSIPID_TESTRIG_UIN" ] && errors+=("MOSIPID_TESTRIG_UIN (secrets)") - [ -z "$MOSIPID_TESTRIG_VID" ] && errors+=("MOSIPID_TESTRIG_VID (secrets)") - [ -z "$MOSIPID_TESTRIG_PHONE_NUMBER" ] && errors+=("MOSIPID_TESTRIG_PHONE_NUMBER (secrets)") - [ -z "$MOSIPID_TESTRIG_EMAIL_LOGIN_ID" ] && errors+=("MOSIPID_TESTRIG_EMAIL_LOGIN_ID (secrets)") - [ -z "$MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN" ] && errors+=("MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN (secrets)") + [ -z "$MOSIPID_TESTRIG_UIN" ] && errors+=("MOSIPID_TESTRIG_UIN (vars)") + [ -z "$MOSIPID_TESTRIG_VID" ] && errors+=("MOSIPID_TESTRIG_VID (vars)") + [ -z "$MOSIPID_TESTRIG_PHONE_NUMBER" ] && errors+=("MOSIPID_TESTRIG_PHONE_NUMBER (vars)") + [ -z "$MOSIPID_TESTRIG_EMAIL_LOGIN_ID" ] && errors+=("MOSIPID_TESTRIG_EMAIL_LOGIN_ID (vars)") + [ -z "$MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN" ] && errors+=("MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN (vars)") [ -z "$MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD" ] && errors+=("MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD (secrets)") if [ ${#errors[@]} -gt 0 ]; then echo "❌ Missing required Environment values for esignet-standalone-2.0.0 testrigs:" diff --git a/docs/HELMSMAN_TESTRIGS_GUIDE.md b/docs/HELMSMAN_TESTRIGS_GUIDE.md index 89ced39a0..1407261e3 100644 --- a/docs/HELMSMAN_TESTRIGS_GUIDE.md +++ b/docs/HELMSMAN_TESTRIGS_GUIDE.md @@ -68,25 +68,27 @@ No additional secrets required for testrigs — captcha and keycloak secrets wer **Required Environment Secrets/Variables** (Settings → Environments → ``): +Only actual credentials (passwords, client secrets) are **Secrets** below — everything else (IDs, test identities) is a plain **Variable**, even where it's technically PII, to keep the GitHub Environment setup simple. + | Secret/Variable | Type | Used by | Description | |---|---|---|---| | `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` | Secret | uitestrig, all 3 instances | Reuses the same Keycloak admin password `esignet-misp-onboarder-mosipid-preinstall.sh` already needs — one shared `mosip/keycloak` release for the whole profile | | `ESIGNET_UITESTRIG_OIDC_CLIENT_ID` | Variable | uitestrig, all 3 instances | Pre-provisioned OIDC client ID for browser login testing (reused across instances, same pattern as `mock-relying-party-service`'s shared `CLIENT_ID` in `esignet-dsf.yaml`) | | `ESIGNET_UITESTRIG_CLIENT_SECRET` | Secret | uitestrig, all 3 instances | Secret for the client above | -| `MOSIPID_TESTRIG_INDIVIDUAL_ID` | Secret | apitestrig, `esignet-mosipid` only | Real IDA test identity (UIN) — PII | -| `MOSIPID_TESTRIG_OTP_RECIPIENT` | Secret | apitestrig, `esignet-mosipid` only | Phone/email that receives the test OTP | +| `MOSIPID_TESTRIG_INDIVIDUAL_ID` | Variable | apitestrig, `esignet-mosipid` only | Real IDA test identity (UIN) | +| `MOSIPID_TESTRIG_OTP_RECIPIENT` | Variable | apitestrig, `esignet-mosipid` only | Phone/email that receives the test OTP | | `MOSIPID_TESTRIG_AUTH_PARTNER_ID` | Variable | apitestrig, `esignet-mosipid` only | Auth partner ID used to build the test client ID | | `MOSIPID_TESTRIG_AUTH_POLICY_ID` | Variable | apitestrig, `esignet-mosipid` only | Policy ID used to build the test client ID | -| `MOSIPID_TESTRIG_UIN` | Secret | uitestrig, `esignet-mosipid` only | Test UIN — PII | -| `MOSIPID_TESTRIG_VID` | Secret | uitestrig, `esignet-mosipid` only | Test VID — PII | -| `MOSIPID_TESTRIG_PHONE_NUMBER` | Secret | uitestrig, `esignet-mosipid` only | Test UIN's phone number — PII | -| `MOSIPID_TESTRIG_EMAIL_LOGIN_ID` | Secret | uitestrig, `esignet-mosipid` only | Test identity for email-OTP login scenarios | -| `MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN` | Secret | uitestrig, `esignet-mosipid` only | Test identity for password-login scenarios | +| `MOSIPID_TESTRIG_UIN` | Variable | uitestrig, `esignet-mosipid` only | Test UIN | +| `MOSIPID_TESTRIG_VID` | Variable | uitestrig, `esignet-mosipid` only | Test VID | +| `MOSIPID_TESTRIG_PHONE_NUMBER` | Variable | uitestrig, `esignet-mosipid` only | Test UIN's phone number | +| `MOSIPID_TESTRIG_EMAIL_LOGIN_ID` | Variable | uitestrig, `esignet-mosipid` only | Test identity for email-OTP login scenarios | +| `MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN` | Variable | uitestrig, `esignet-mosipid` only | Test identity for password-login scenarios | | `MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD` | Secret | uitestrig, `esignet-mosipid` only | Password for the identity above | Only `esignet-mosipid` needs real test-identity/onboarding values — it's the only instance backed by a real IDA identity (`config.mosip.json`/the `mosip` plugin). `esignet-mock` (`config.mock.json`/`mock` plugin) and `esignet-sunbird` (`config.sunbird.json`/`sunbird` plugin) need none of the `MOSIPID_TESTRIG_*` values above. -The workflow's own "Validate esignet-standalone-2.0.0 testrig secrets" step fails clearly, listing exactly which of these are missing, before it tries to deploy. +The workflow's own "Validate esignet-standalone-2.0.0 testrig secrets/variables" step fails clearly, listing exactly which of these are missing, before it tries to deploy. Report storage uses a PVC (`reports.persistence.enabled: true`), not S3 — there's no established MinIO bucket convention for these charts yet in this repo. Switch to `reports.s3.*` once one exists. From 4840db349ba56beef9e11651d04adde2fe7309ab Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 25 Sep 2026 18:13:51 +0530 Subject: [PATCH 124/127] esignet-standalone-2.0.0: add mock-rp-oidc propertiesOverride, run mock-rp-onboarder first esignet-mock-rp-onboarder had no onboarding.propertiesOverride.mock-rp-oidc.* values at all - only generic module/s3/domainConfig config, unlike esignet-misp-onboarder's own propertiesOverride.esignet.* block. Add the mock-rp-oidc module's business values (POLICY_NAME, OIDC_CLIENTID, REDIRECT_URIS, etc.), adapted to this instance with ${domain_name} substitution in place of the reference's sandbox.mosip.net placeholders. KEYCLOAK_ADMIN_PASSWORD/KEYCLOAK_CLIENT_SECRET/mosip_pms_client_secret are deliberately left out of propertiesOverride - putting real credentials in a committed DSF file would be wrong. They reach the onboarding Job as real secret env vars instead, via the same extraEnvVarsSecret mechanism esignet-misp-onboarder already uses - esignet-mock-rp-onboarder-preinstall.sh already copies both the "keycloak" and "keycloak-client-secrets" secrets into esignet-mock, but the DSF never actually wired them in via extraEnvVarsSecret until now. Also swap priorities so esignet-mock-rp-onboarder (-6) now runs before esignet-misp-onboarder (-5), reversing the previous order. The two run in separate namespaces against separate deployments (esignet-mock vs. esignet-mosipid), so there's no real ordering dependency either way - comments updated to match. Signed-off-by: bhumi46 Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 40 +++++++++++++++++-- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 6bddb661c..5f2b5e057 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -768,7 +768,8 @@ apps: # eSignet MISP Partner Onboarder # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). - # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. + # Runs AFTER mock-rp-onboarder (separate namespaces/deployments — esignet-mosipid vs. + # esignet-mock — so there's no ordering dependency between the two either way). # After completion, restarts the esignet deployment to pick up the new MISP license key. esignet-misp-onboarder: namespace: esignet-mosipid @@ -820,7 +821,7 @@ apps: wait: true waitForJobs: true timeout: 600 - priority: -6 + priority: -5 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh" @@ -830,6 +831,7 @@ apps: # Mock RP OIDC Partner Onboarder # Onboards the mock relying party as an OIDC client. # Enable for plugin 1 (mock) or plugin 3 (sunbird-rc). Set mosipid: "true" for mosip-identity-plugin. + # Runs BEFORE esignet-misp-onboarder. esignet-mock-rp-onboarder: namespace: esignet-mock enabled: true @@ -849,8 +851,40 @@ apps: onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.mosipid: "false" onboarding.variables.push_reports_to_s3: "true" + # Properties-driven model for inline-hardcoded business values, matching the + # reference partner-onboarder/values.yaml mock-rp-oidc module, adapted to this + # instance (EXTERNAL_URL/URL/AUTHMANAGER_URL/PMS_URL/KEYCLOAK_URL/LOGO_URI/ + # REDIRECT_URIS use ${domain_name} instead of the reference's sandbox.mosip.net). + # KEYCLOAK_ADMIN_PASSWORD/KEYCLOAK_CLIENT_SECRET/mosip_pms_client_secret are + # deliberately NOT set here — same as esignet-misp-onboarder below, they reach the + # onboarding Job as real secret env vars via extraEnvVarsSecret, never as a + # plaintext value in this file. + onboarding.propertiesOverride.mock-rp-oidc.POLICY_NAME: "mpolicy-default-mock-rp-oidc" + onboarding.propertiesOverride.mock-rp-oidc.POLICY_GROUP_NAME: "mpolicygroup-default-mock-rp-oidc" + onboarding.propertiesOverride.mock-rp-oidc.PARTNER_KC_USERNAME: "mpartner-default-mock-rp-oidc" + onboarding.propertiesOverride.mock-rp-oidc.PARTNER_MANAGER_USERNAME: "mock-rp-oidc-kc-mockusername" + onboarding.propertiesOverride.mock-rp-oidc.PARTNER_MANAGER_PASSWORD: "mock-rp-oidc-kc-mockuserpassword" + onboarding.propertiesOverride.mock-rp-oidc.OIDC_CLIENTID: "default-non-mosipid-oidc-client" + onboarding.propertiesOverride.mock-rp-oidc.OIDC_CLIENT_NAME: "Health service OIDC Client" + # esignet-mock uses the mock plugin (plugin 1), not mosip-identity-plugin. + onboarding.propertiesOverride.mock-rp-oidc.MOSIP_ID: "false" + onboarding.propertiesOverride.mock-rp-oidc.LOGO_URI: "https://healthservices.${domain_name}/logo.png" + onboarding.propertiesOverride.mock-rp-oidc.REDIRECT_URIS: "https://healthservices.${domain_name}/userprofile" + onboarding.propertiesOverride.mock-rp-oidc.URL: "https://api-internal.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.AUTHMANAGER_URL: "https://api-internal.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.PMS_URL: "https://api-internal.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.KEYCLOAK_URL: "https://iam.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.EXTERNAL_URL: "https://esignet.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.KEYCLOAK_ADMIN_USERNAME: "admin" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host" + # esignet-mock-rp-onboarder-preinstall.sh already copies both of these into + # esignet-mock — wiring them here is what actually gets KEYCLOAK_ADMIN_PASSWORD + # (from the "keycloak" secret) and KEYCLOAK_CLIENT_SECRET/mosip_pms_client_secret + # (from "keycloak-client-secrets") into the Job's environment, same pattern as + # esignet-misp-onboarder's own extraEnvVarsSecret below. + extraEnvVarsSecret[0]: "keycloak" + extraEnvVarsSecret[1]: "keycloak-client-secrets" domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" domainConfig.mosip-api-host: "api.${domain_name}" domainConfig.mosip-esignet-host: "esignet.${domain_name}" @@ -860,7 +894,7 @@ apps: wait: true waitForJobs: true timeout: 600 - priority: -5 + priority: -6 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh" From d664dc4390d28ab1cc54f4ba692aa5f1c77b36eb Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 25 Sep 2026 18:26:10 +0530 Subject: [PATCH 125/127] esignet-mock-rp-onboarder: point mock-rp-oidc at esignet-go-mock/healthservices-go-mock Use esignet-go-mock/healthservices-go-mock hostnames for LOGO_URI/REDIRECT_URIS/ EXTERNAL_URL instead of the plain esignet/healthservices ones, and tighten the propertiesOverride block's own explanatory comment. Signed-off-by: bhumi46 Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 21 ++++++++----------- 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 5f2b5e057..69562adfb 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -851,14 +851,12 @@ apps: onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.mosipid: "false" onboarding.variables.push_reports_to_s3: "true" - # Properties-driven model for inline-hardcoded business values, matching the - # reference partner-onboarder/values.yaml mock-rp-oidc module, adapted to this - # instance (EXTERNAL_URL/URL/AUTHMANAGER_URL/PMS_URL/KEYCLOAK_URL/LOGO_URI/ - # REDIRECT_URIS use ${domain_name} instead of the reference's sandbox.mosip.net). - # KEYCLOAK_ADMIN_PASSWORD/KEYCLOAK_CLIENT_SECRET/mosip_pms_client_secret are - # deliberately NOT set here — same as esignet-misp-onboarder below, they reach the - # onboarding Job as real secret env vars via extraEnvVarsSecret, never as a - # plaintext value in this file. + # Properties-driven values for the mock-rp-oidc module, adapted to this instance + # (esignet-go-mock / healthservices-go-mock). KEYCLOAK_ADMIN_PASSWORD, + # KEYCLOAK_CLIENT_SECRET and mosip_pms_client_secret are intentionally not set here: + # propertiesOverride renders into a plain ConfigMap, and the job already gets them + # from the keycloak / keycloak-client-secrets Secrets (chart-default + # extraEnvVarsSecret, copied into this namespace by the preinstall hook). onboarding.propertiesOverride.mock-rp-oidc.POLICY_NAME: "mpolicy-default-mock-rp-oidc" onboarding.propertiesOverride.mock-rp-oidc.POLICY_GROUP_NAME: "mpolicygroup-default-mock-rp-oidc" onboarding.propertiesOverride.mock-rp-oidc.PARTNER_KC_USERNAME: "mpartner-default-mock-rp-oidc" @@ -866,15 +864,14 @@ apps: onboarding.propertiesOverride.mock-rp-oidc.PARTNER_MANAGER_PASSWORD: "mock-rp-oidc-kc-mockuserpassword" onboarding.propertiesOverride.mock-rp-oidc.OIDC_CLIENTID: "default-non-mosipid-oidc-client" onboarding.propertiesOverride.mock-rp-oidc.OIDC_CLIENT_NAME: "Health service OIDC Client" - # esignet-mock uses the mock plugin (plugin 1), not mosip-identity-plugin. onboarding.propertiesOverride.mock-rp-oidc.MOSIP_ID: "false" - onboarding.propertiesOverride.mock-rp-oidc.LOGO_URI: "https://healthservices.${domain_name}/logo.png" - onboarding.propertiesOverride.mock-rp-oidc.REDIRECT_URIS: "https://healthservices.${domain_name}/userprofile" + onboarding.propertiesOverride.mock-rp-oidc.LOGO_URI: "https://healthservices-go-mock.${domain_name}/logo.png" + onboarding.propertiesOverride.mock-rp-oidc.REDIRECT_URIS: "https://healthservices-go-mock.${domain_name}/userprofile" onboarding.propertiesOverride.mock-rp-oidc.URL: "https://api-internal.${domain_name}" onboarding.propertiesOverride.mock-rp-oidc.AUTHMANAGER_URL: "https://api-internal.${domain_name}" onboarding.propertiesOverride.mock-rp-oidc.PMS_URL: "https://api-internal.${domain_name}" onboarding.propertiesOverride.mock-rp-oidc.KEYCLOAK_URL: "https://iam.${domain_name}" - onboarding.propertiesOverride.mock-rp-oidc.EXTERNAL_URL: "https://esignet.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.EXTERNAL_URL: "https://esignet-go-mock.${domain_name}" onboarding.propertiesOverride.mock-rp-oidc.KEYCLOAK_ADMIN_USERNAME: "admin" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host" From 566d61d9525b39f54fce02fa198e7fc765d81c1b Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 25 Sep 2026 18:45:28 +0530 Subject: [PATCH 126/127] esignet-standalone-2.0.0 testrigs: default to changeme, drop validation gate The hard "Validate esignet-standalone-2.0.0 testrig secrets/variables" step failed the whole helmsman apply whenever any of the 13 new testrig secrets/vars weren't already configured - which none of them were yet, so every 2.0.0 testrig deploy failed outright. Remove that step, and give every one of those values a changeme fallback (matching eSignet's own testrig values.secret.yaml.example placeholder convention) so deployment always succeeds. A changeme deployment still gets a working apitestrig/uitestrig on its normal cron schedule - real values only need to land before an actual test run, updated in the Environment and picked up on the next trigger, no redeploy required. Also remove trigger-test-jobs-esignet.sh for this profile - it was never actually wired as a postInstall hook anywhere in testrigs-dsf.yaml (the only reference to it was the doc's own, incorrect "fires automatically" claim), and there's no need to trigger cronjobs immediately after deploy - they already run on their own configured schedule. docs/HELMSMAN_TESTRIGS_GUIDE.md updated to match: the secrets/variables table now says "Optional" with the changeme-fallback explanation instead of "Required", and the Post-Deployment section no longer claims esignet-standalone-2.0.0 has an auto-trigger step. Signed-off-by: bhumi46 Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS --- .github/workflows/helmsman_testrigs.yml | 59 +++---- .../trigger-test-jobs-esignet.sh | 148 ------------------ docs/HELMSMAN_TESTRIGS_GUIDE.md | 19 +-- 3 files changed, 28 insertions(+), 198 deletions(-) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 7bbc0d8d3..3580665ea 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -130,25 +130,33 @@ jobs: # mock-relying-party-service's own CLIENT_ID constant in esignet-dsf.yaml. # Only actual credentials (passwords/client secrets) are GitHub Secrets below — # everything else (IDs, test identities) is a plain Environment Variable. - ESIGNET_UITESTRIG_OIDC_CLIENT_ID: ${{ vars.ESIGNET_UITESTRIG_OIDC_CLIENT_ID }} - ESIGNET_UITESTRIG_CLIENT_SECRET: ${{ secrets.ESIGNET_UITESTRIG_CLIENT_SECRET }} + # + # All fall back to a placeholder default ("changeme", matching eSignet's own + # testrig values.secret.yaml.example convention) so a plain `helmsman apply` never + # fails for not having these configured yet. Deploying with the placeholder still + # gets a working apitestrig/uitestrig deployment on its normal cron schedule — + # update the actual GitHub Environment secret/variable with a real value, and set + # it on the CronJob (or trigger a one-off Job from it) whenever you're ready to + # run a real, passing test — no redeploy needed for that. + ESIGNET_UITESTRIG_OIDC_CLIENT_ID: ${{ vars.ESIGNET_UITESTRIG_OIDC_CLIENT_ID || 'changeme' }} + ESIGNET_UITESTRIG_CLIENT_SECRET: ${{ secrets.ESIGNET_UITESTRIG_CLIENT_SECRET || 'changeme' }} # Single shared Keycloak admin password (one mosip/keycloak release for the whole # profile — see external-dsf.yaml) — already provisioned for the MISP onboarder. - MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD }} + MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD || 'changeme' }} # esignet-mosipid apitestrig/uitestrig only — config.mosip.json (apitestrig) and the # MOSIP-ID plugin path (uitestrig) are the only ones backed by a real IDA identity, so # these are the only instance that needs real test-identity/onboarding values. esignet-mock # (config.mock.json) and esignet-sunbird (config.sunbird.json) need none of this. - MOSIPID_TESTRIG_INDIVIDUAL_ID: ${{ vars.MOSIPID_TESTRIG_INDIVIDUAL_ID }} - MOSIPID_TESTRIG_OTP_RECIPIENT: ${{ vars.MOSIPID_TESTRIG_OTP_RECIPIENT }} - MOSIPID_TESTRIG_AUTH_PARTNER_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_PARTNER_ID }} - MOSIPID_TESTRIG_AUTH_POLICY_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_POLICY_ID }} - MOSIPID_TESTRIG_UIN: ${{ vars.MOSIPID_TESTRIG_UIN }} - MOSIPID_TESTRIG_VID: ${{ vars.MOSIPID_TESTRIG_VID }} - MOSIPID_TESTRIG_PHONE_NUMBER: ${{ vars.MOSIPID_TESTRIG_PHONE_NUMBER }} - MOSIPID_TESTRIG_EMAIL_LOGIN_ID: ${{ vars.MOSIPID_TESTRIG_EMAIL_LOGIN_ID }} - MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN: ${{ vars.MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN }} - MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD: ${{ secrets.MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD }} + MOSIPID_TESTRIG_INDIVIDUAL_ID: ${{ vars.MOSIPID_TESTRIG_INDIVIDUAL_ID || 'changeme' }} + MOSIPID_TESTRIG_OTP_RECIPIENT: ${{ vars.MOSIPID_TESTRIG_OTP_RECIPIENT || 'changeme' }} + MOSIPID_TESTRIG_AUTH_PARTNER_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_PARTNER_ID || 'changeme' }} + MOSIPID_TESTRIG_AUTH_POLICY_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_POLICY_ID || 'changeme' }} + MOSIPID_TESTRIG_UIN: ${{ vars.MOSIPID_TESTRIG_UIN || 'changeme' }} + MOSIPID_TESTRIG_VID: ${{ vars.MOSIPID_TESTRIG_VID || 'changeme' }} + MOSIPID_TESTRIG_PHONE_NUMBER: ${{ vars.MOSIPID_TESTRIG_PHONE_NUMBER || 'changeme' }} + MOSIPID_TESTRIG_EMAIL_LOGIN_ID: ${{ vars.MOSIPID_TESTRIG_EMAIL_LOGIN_ID || 'changeme' }} + MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN: ${{ vars.MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN || 'changeme' }} + MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD: ${{ secrets.MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD || 'changeme' }} steps: - name: Checkout repository uses: actions/checkout@v4 @@ -320,31 +328,6 @@ jobs: echo "❌ secret minio not found in minio namespace"; exit 1 fi - - name: Validate esignet-standalone-2.0.0 testrig secrets/variables - if: env.PROFILE == 'esignet-standalone-2.0.0' - run: | - errors=() - [ -z "$ESIGNET_UITESTRIG_OIDC_CLIENT_ID" ] && errors+=("ESIGNET_UITESTRIG_OIDC_CLIENT_ID (vars)") - [ -z "$ESIGNET_UITESTRIG_CLIENT_SECRET" ] && errors+=("ESIGNET_UITESTRIG_CLIENT_SECRET (secrets)") - [ -z "$MOSIPID_KEYCLOAK_ADMIN_PASSWORD" ] && errors+=("MOSIPID_KEYCLOAK_ADMIN_PASSWORD (secrets)") - [ -z "$MOSIPID_TESTRIG_INDIVIDUAL_ID" ] && errors+=("MOSIPID_TESTRIG_INDIVIDUAL_ID (vars)") - [ -z "$MOSIPID_TESTRIG_OTP_RECIPIENT" ] && errors+=("MOSIPID_TESTRIG_OTP_RECIPIENT (vars)") - [ -z "$MOSIPID_TESTRIG_AUTH_PARTNER_ID" ] && errors+=("MOSIPID_TESTRIG_AUTH_PARTNER_ID (vars)") - [ -z "$MOSIPID_TESTRIG_AUTH_POLICY_ID" ] && errors+=("MOSIPID_TESTRIG_AUTH_POLICY_ID (vars)") - [ -z "$MOSIPID_TESTRIG_UIN" ] && errors+=("MOSIPID_TESTRIG_UIN (vars)") - [ -z "$MOSIPID_TESTRIG_VID" ] && errors+=("MOSIPID_TESTRIG_VID (vars)") - [ -z "$MOSIPID_TESTRIG_PHONE_NUMBER" ] && errors+=("MOSIPID_TESTRIG_PHONE_NUMBER (vars)") - [ -z "$MOSIPID_TESTRIG_EMAIL_LOGIN_ID" ] && errors+=("MOSIPID_TESTRIG_EMAIL_LOGIN_ID (vars)") - [ -z "$MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN" ] && errors+=("MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN (vars)") - [ -z "$MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD" ] && errors+=("MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD (secrets)") - if [ ${#errors[@]} -gt 0 ]; then - echo "❌ Missing required Environment values for esignet-standalone-2.0.0 testrigs:" - printf ' - %s\n' "${errors[@]}" - echo "Go to: Settings → Environments → ${{ github.ref_name }} → Secrets/Variables" - exit 1 - fi - echo "✅ All esignet-standalone-2.0.0 testrig secrets/variables are configured" - - name: Get PMS client secret (esignet-standalone-2.0.0 apitestrig) if: env.PROFILE == 'esignet-standalone-2.0.0' run: | diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh deleted file mode 100755 index ed2f4a274..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh +++ /dev/null @@ -1,148 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet Standalone 2.0.0 - Trigger Testrig CronJobs -# ============================================================================= -# Immediately triggers testrig CronJobs after deployment: -# apitestrig → esignet-mock / esignet-mosipid / esignet-sunbird ns -# uitestrig → esignet-uitestrig / esignet-mosipid-uitestrig / -# esignet-sunbird-uitestrig ns -# signup-apitestrig → signup ns (if deployed) -# signup-uitestrig → signup-uitestrig ns (if deployed) -# ============================================================================= -set -euo pipefail - -CONTINUE_ON_FAILURE="${CONTINUE_ON_FAILURE:-true}" -JOB_TIMEOUT="${JOB_TIMEOUT:-5400}" -OVERALL_SUCCESS=true - -# Runs `kubectl "$@"`, printing stdout on success. -# Returns 0 on success, 2 for a genuine NotFound (caller should treat the -# resource as absent), or 1 with the error printed to stderr for any other -# kubectl failure (RBAC, credentials, API errors) so real problems aren't -# silently swallowed alongside the expected "doesn't exist" case. -kubectl_get() { - local output rc=0 - output=$(kubectl "$@" 2>&1) || rc=$? - if [[ $rc -eq 0 ]]; then - printf '%s' "$output" - return 0 - fi - if echo "$output" | grep -q '(NotFound)'; then - return 2 - fi - echo "✗ kubectl $* failed: $output" >&2 - return 1 -} - -trigger_and_wait() { - local ns=$1 cronjob=$2 - - local rc=0 - kubectl_get get cronjob -n "$ns" "$cronjob" -o name >/dev/null || rc=$? - if [[ $rc -eq 2 ]]; then - echo "⏭ CronJob $cronjob not found in $ns — skipping" - return 0 - elif [[ $rc -ne 0 ]]; then - return 1 - fi - - local job_name="${cronjob}-manual-$(date +%s)" - echo "▶ Creating $job_name from $cronjob in $ns" - kubectl create job -n "$ns" "$job_name" --from="cronjob/$cronjob" - - local elapsed=0 - while [[ $elapsed -lt $JOB_TIMEOUT ]]; do - local complete failed - rc=0 - complete=$(kubectl_get get job -n "$ns" "$job_name" \ - -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}') || rc=$? - if [[ $rc -eq 2 ]]; then - echo " ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..." - sleep 10 - elapsed=$((elapsed + 10)) - continue - elif [[ $rc -ne 0 ]]; then - return 1 - fi - rc=0 - failed=$(kubectl_get get job -n "$ns" "$job_name" \ - -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}') || rc=$? - if [[ $rc -eq 2 ]]; then - echo " ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..." - sleep 10 - elapsed=$((elapsed + 10)) - continue - elif [[ $rc -ne 0 ]]; then - return 1 - fi - [[ "$complete" == "True" ]] && { echo "✓ $job_name completed successfully"; return 0; } - [[ "$failed" == "True" ]] && { - echo "✗ $job_name failed" >&2 - kubectl logs -n "$ns" -l "job-name=$job_name" --tail=50 2>/dev/null || true - return 1 - } - echo " ⏳ $job_name running (${elapsed}s elapsed)..." - sleep 10 - elapsed=$((elapsed + 10)) - done - - echo "✗ $job_name timed out after ${JOB_TIMEOUT}s" >&2 - return 1 -} - -trigger_all_in_ns() { - local ns=$1 - local cronjobs rc=0 - cronjobs=$(kubectl_get get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}') || rc=$? - if [[ $rc -eq 2 ]]; then - echo "⏭ No CronJobs found in $ns — skipping" - return 0 - elif [[ $rc -ne 0 ]]; then - return 1 - fi - if [[ -z "$cronjobs" ]]; then - echo "⏭ No CronJobs found in $ns — skipping" - return 0 - fi - for cj in $cronjobs; do - trigger_and_wait "$ns" "$cj" || return 1 - done -} - -echo "================================================" -echo "eSignet Standalone 2.0.0 - Trigger Testrig CronJobs" -echo "================================================" - -echo "=== eSignet API Testrig (esignet-mock ns) ===" -trigger_all_in_ns esignet-mock || OVERALL_SUCCESS=false - -echo "=== eSignet-MOSIPID API Testrig (esignet-mosipid ns) ===" -trigger_all_in_ns esignet-mosipid || OVERALL_SUCCESS=false - -echo "=== eSignet-Sunbird API Testrig (esignet-sunbird ns) ===" -trigger_all_in_ns esignet-sunbird || OVERALL_SUCCESS=false - -echo "=== eSignet UI Testrig (esignet-uitestrig ns) ===" -trigger_all_in_ns esignet-uitestrig || OVERALL_SUCCESS=false - -echo "=== eSignet-MOSIPID UI Testrig (esignet-mosipid-uitestrig ns) ===" -trigger_all_in_ns esignet-mosipid-uitestrig || OVERALL_SUCCESS=false - -echo "=== eSignet-Sunbird UI Testrig (esignet-sunbird-uitestrig ns) ===" -trigger_all_in_ns esignet-sunbird-uitestrig || OVERALL_SUCCESS=false - -echo "=== Signup API Testrig (signup ns, if deployed) ===" -trigger_all_in_ns signup || OVERALL_SUCCESS=false - -echo "=== Signup UI Testrig (signup-uitestrig ns, if deployed) ===" -trigger_all_in_ns signup-uitestrig || OVERALL_SUCCESS=false - -echo "" -echo "=== Testrig Execution Summary ===" -if [[ "$OVERALL_SUCCESS" == "true" ]]; then - echo "✓ All testrig jobs completed successfully" - exit 0 -else - echo "✗ One or more testrig jobs failed" - exit 1 -fi diff --git a/docs/HELMSMAN_TESTRIGS_GUIDE.md b/docs/HELMSMAN_TESTRIGS_GUIDE.md index 1407261e3..be19bcabf 100644 --- a/docs/HELMSMAN_TESTRIGS_GUIDE.md +++ b/docs/HELMSMAN_TESTRIGS_GUIDE.md @@ -66,7 +66,9 @@ No additional secrets required for testrigs — captcha and keycloak secrets wer | `KEYCLOAK_CLIENT_SECRET` (apitestrig, all 3 instances) | `keycloak-client-secrets` secret in the `keycloak` namespace — the same `mosip_pms_client_secret` key `esignet-preinstall-keycloak-init.sh` already uses | | `esignetDbPassword` (uitestrig, all 3 instances) | `db-common-secrets` secret in the `postgres` namespace | -**Required Environment Secrets/Variables** (Settings → Environments → ``): +**Optional Environment Secrets/Variables** (Settings → Environments → ``): + +None of these are required to deploy — every one falls back to the literal placeholder `changeme` (matching eSignet's own testrig `values.secret.yaml.example` convention) if not configured, so `helmsman apply` never fails for missing them. A `changeme` deployment still gets you a working apitestrig/uitestrig on their normal cron schedule; it just won't produce a passing *test run* until the real value is in place. Set the real value in the Environment whenever you're ready for that, then trigger a fresh run — no redeploy needed. Only actual credentials (passwords, client secrets) are **Secrets** below — everything else (IDs, test identities) is a plain **Variable**, even where it's technically PII, to keep the GitHub Environment setup simple. @@ -88,8 +90,6 @@ Only actual credentials (passwords, client secrets) are **Secrets** below — ev Only `esignet-mosipid` needs real test-identity/onboarding values — it's the only instance backed by a real IDA identity (`config.mosip.json`/the `mosip` plugin). `esignet-mock` (`config.mock.json`/`mock` plugin) and `esignet-sunbird` (`config.sunbird.json`/`sunbird` plugin) need none of the `MOSIPID_TESTRIG_*` values above. -The workflow's own "Validate esignet-standalone-2.0.0 testrig secrets/variables" step fails clearly, listing exactly which of these are missing, before it tries to deploy. - Report storage uses a PVC (`reports.persistence.enabled: true`), not S3 — there's no established MinIO bucket convention for these charts yet in this repo. Switch to `reports.s3.*` once one exists. ### MOSIP platform profiles only @@ -183,23 +183,18 @@ kubectl create job --from=cronjob/cronjob-dslorchestrator-full dslrig-manual-run > kubectl logs -f job/dslrig-manual-run -n dslrig > ``` -**3. Trigger eSignet test jobs (eSignet standalone profiles)** - -The `trigger-test-jobs-esignet.sh` postInstall hook fires automatically after the last testrig deploys — it triggers all cronjobs across all 3 esignet namespaces sequentially and optionally signup/signup-uitestrig if deployed. +**3. Trigger eSignet test jobs (`esignet-standalone` profile only)** -To trigger manually: +`trigger-test-jobs-esignet.sh` is a manual-only script — nothing triggers it automatically after deploy (the DSF's own `postInstall` hook line that would have called it is commented out). Run it by hand if you want an immediate run instead of waiting for the next scheduled CronJob fire: ```bash export KUBECONFIG=/path/to/kubeconfig export WORKDIR=/path/to/Helmsman - -# esignet-standalone ./hooks/esignet-standalone/trigger-test-jobs-esignet.sh - -# esignet-standalone-2.0.0 -./hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh ``` +`esignet-standalone-2.0.0` has no equivalent script — its apitestrig/uitestrig CronJobs just run on their own configured schedule (`crontime` in each app's `set:` block) with no immediate trigger after deploy. See the note on `changeme` placeholders below if you want to trigger a real run manually. + --- ## Verify From b2bd94e91e6ed559a9be16fce0d4e8e1508fa308 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 25 Sep 2026 19:48:04 +0530 Subject: [PATCH 127/127] esignet-standalone-2.0.0 testrigs: align placeholder with PR #402 Match mosip/infra#402 (esqa1-DSD-10860, already merged) exactly instead of diverging on my own placeholder choice: - UPDATE_BEFORE_RUN instead of changeme, everywhere. - MOSIPID_KEYCLOAK_ADMIN_PASSWORD gets no fallback at all - it's already a required, properly-configured secret from the earlier onboarder work, so a fake placeholder there would mask a real config gap instead of papering over an expected-empty one. docs/HELMSMAN_TESTRIGS_GUIDE.md updated to match #402's own wording for the same sections. Signed-off-by: bhumi46 Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS --- .github/workflows/helmsman_testrigs.yml | 40 ++++++++++++------------- docs/HELMSMAN_TESTRIGS_GUIDE.md | 13 ++++---- 2 files changed, 27 insertions(+), 26 deletions(-) diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 3580665ea..c809c67a9 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -131,32 +131,30 @@ jobs: # Only actual credentials (passwords/client secrets) are GitHub Secrets below — # everything else (IDs, test identities) is a plain Environment Variable. # - # All fall back to a placeholder default ("changeme", matching eSignet's own - # testrig values.secret.yaml.example convention) so a plain `helmsman apply` never - # fails for not having these configured yet. Deploying with the placeholder still - # gets a working apitestrig/uitestrig deployment on its normal cron schedule — - # update the actual GitHub Environment secret/variable with a real value, and set - # it on the CronJob (or trigger a one-off Job from it) whenever you're ready to - # run a real, passing test — no redeploy needed for that. - ESIGNET_UITESTRIG_OIDC_CLIENT_ID: ${{ vars.ESIGNET_UITESTRIG_OIDC_CLIENT_ID || 'changeme' }} - ESIGNET_UITESTRIG_CLIENT_SECRET: ${{ secrets.ESIGNET_UITESTRIG_CLIENT_SECRET || 'changeme' }} + # These testrig-only values are optional for deployment: when unset they default to + # the UPDATE_BEFORE_RUN placeholder so Helmsman can deploy the testrigs; set the real + # values in the testrig configmaps/secrets before triggering the cronjobs. + ESIGNET_UITESTRIG_OIDC_CLIENT_ID: ${{ vars.ESIGNET_UITESTRIG_OIDC_CLIENT_ID || 'UPDATE_BEFORE_RUN' }} + ESIGNET_UITESTRIG_CLIENT_SECRET: ${{ secrets.ESIGNET_UITESTRIG_CLIENT_SECRET || 'UPDATE_BEFORE_RUN' }} # Single shared Keycloak admin password (one mosip/keycloak release for the whole - # profile — see external-dsf.yaml) — already provisioned for the MISP onboarder. - MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD || 'changeme' }} + # profile — see external-dsf.yaml) — already provisioned for the MISP onboarder, so + # no placeholder fallback here: an empty value means the real one genuinely went + # missing, not that it was never expected to exist yet. + MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD }} # esignet-mosipid apitestrig/uitestrig only — config.mosip.json (apitestrig) and the # MOSIP-ID plugin path (uitestrig) are the only ones backed by a real IDA identity, so # these are the only instance that needs real test-identity/onboarding values. esignet-mock # (config.mock.json) and esignet-sunbird (config.sunbird.json) need none of this. - MOSIPID_TESTRIG_INDIVIDUAL_ID: ${{ vars.MOSIPID_TESTRIG_INDIVIDUAL_ID || 'changeme' }} - MOSIPID_TESTRIG_OTP_RECIPIENT: ${{ vars.MOSIPID_TESTRIG_OTP_RECIPIENT || 'changeme' }} - MOSIPID_TESTRIG_AUTH_PARTNER_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_PARTNER_ID || 'changeme' }} - MOSIPID_TESTRIG_AUTH_POLICY_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_POLICY_ID || 'changeme' }} - MOSIPID_TESTRIG_UIN: ${{ vars.MOSIPID_TESTRIG_UIN || 'changeme' }} - MOSIPID_TESTRIG_VID: ${{ vars.MOSIPID_TESTRIG_VID || 'changeme' }} - MOSIPID_TESTRIG_PHONE_NUMBER: ${{ vars.MOSIPID_TESTRIG_PHONE_NUMBER || 'changeme' }} - MOSIPID_TESTRIG_EMAIL_LOGIN_ID: ${{ vars.MOSIPID_TESTRIG_EMAIL_LOGIN_ID || 'changeme' }} - MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN: ${{ vars.MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN || 'changeme' }} - MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD: ${{ secrets.MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD || 'changeme' }} + MOSIPID_TESTRIG_INDIVIDUAL_ID: ${{ vars.MOSIPID_TESTRIG_INDIVIDUAL_ID || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_OTP_RECIPIENT: ${{ vars.MOSIPID_TESTRIG_OTP_RECIPIENT || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_AUTH_PARTNER_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_PARTNER_ID || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_AUTH_POLICY_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_POLICY_ID || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_UIN: ${{ vars.MOSIPID_TESTRIG_UIN || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_VID: ${{ vars.MOSIPID_TESTRIG_VID || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_PHONE_NUMBER: ${{ vars.MOSIPID_TESTRIG_PHONE_NUMBER || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_EMAIL_LOGIN_ID: ${{ vars.MOSIPID_TESTRIG_EMAIL_LOGIN_ID || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN: ${{ vars.MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD: ${{ secrets.MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD || 'UPDATE_BEFORE_RUN' }} steps: - name: Checkout repository uses: actions/checkout@v4 diff --git a/docs/HELMSMAN_TESTRIGS_GUIDE.md b/docs/HELMSMAN_TESTRIGS_GUIDE.md index be19bcabf..fe14cbaf5 100644 --- a/docs/HELMSMAN_TESTRIGS_GUIDE.md +++ b/docs/HELMSMAN_TESTRIGS_GUIDE.md @@ -68,7 +68,7 @@ No additional secrets required for testrigs — captcha and keycloak secrets wer **Optional Environment Secrets/Variables** (Settings → Environments → ``): -None of these are required to deploy — every one falls back to the literal placeholder `changeme` (matching eSignet's own testrig `values.secret.yaml.example` convention) if not configured, so `helmsman apply` never fails for missing them. A `changeme` deployment still gets you a working apitestrig/uitestrig on their normal cron schedule; it just won't produce a passing *test run* until the real value is in place. Set the real value in the Environment whenever you're ready for that, then trigger a fresh run — no redeploy needed. +Except `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` (already required by the eSignet deployment), each of these defaults to the placeholder `UPDATE_BEFORE_RUN` when unset, so Helmsman can deploy the testrigs without them. Update the real values in the testrig configmaps/secrets before triggering the test cronjobs. Only actual credentials (passwords, client secrets) are **Secrets** below — everything else (IDs, test identities) is a plain **Variable**, even where it's technically PII, to keep the GitHub Environment setup simple. @@ -90,6 +90,8 @@ Only actual credentials (passwords, client secrets) are **Secrets** below — ev Only `esignet-mosipid` needs real test-identity/onboarding values — it's the only instance backed by a real IDA identity (`config.mosip.json`/the `mosip` plugin). `esignet-mock` (`config.mock.json`/`mock` plugin) and `esignet-sunbird` (`config.sunbird.json`/`sunbird` plugin) need none of the `MOSIPID_TESTRIG_*` values above. +There is no validation step for these values; the placeholder defaults let the deployment succeed. + Report storage uses a PVC (`reports.persistence.enabled: true`), not S3 — there's no established MinIO bucket convention for these charts yet in this repo. Switch to `reports.s3.*` once one exists. ### MOSIP platform profiles only @@ -183,18 +185,19 @@ kubectl create job --from=cronjob/cronjob-dslorchestrator-full dslrig-manual-run > kubectl logs -f job/dslrig-manual-run -n dslrig > ``` -**3. Trigger eSignet test jobs (`esignet-standalone` profile only)** +**3. Trigger eSignet test jobs (eSignet standalone profiles)** + +Test cronjobs are not triggered automatically after deployment. For `esignet-standalone`, trigger them with `trigger-test-jobs-esignet.sh` (all cronjobs across the esignet namespaces, plus signup/signup-uitestrig if deployed). For `esignet-standalone-2.0.0`, update the testrig values first, then trigger the cronjobs manually (for example `kubectl -n create job --from=cronjob/ `). -`trigger-test-jobs-esignet.sh` is a manual-only script — nothing triggers it automatically after deploy (the DSF's own `postInstall` hook line that would have called it is commented out). Run it by hand if you want an immediate run instead of waiting for the next scheduled CronJob fire: +To trigger the `esignet-standalone` jobs: ```bash export KUBECONFIG=/path/to/kubeconfig export WORKDIR=/path/to/Helmsman + ./hooks/esignet-standalone/trigger-test-jobs-esignet.sh ``` -`esignet-standalone-2.0.0` has no equivalent script — its apitestrig/uitestrig CronJobs just run on their own configured schedule (`crontime` in each app's `set:` block) with no immediate trigger after deploy. See the note on `changeme` placeholders below if you want to trigger a real run manually. - --- ## Verify