-
Notifications
You must be signed in to change notification settings - Fork 42
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #278 from Rakshitha650/develop
[MOSIP-33894]automated signup-oidc p12 generation and mount the p12 to the signup deployment
- Loading branch information
Showing
10 changed files
with
286 additions
and
18 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| # Partner Onboarder | ||
|
|
||
| ## Overview | ||
| * Upload certificate for default partners. Refer [mosip-onboarding repo](https://github.com/mosip/mosip-onboarding). | ||
|
|
||
| ## Install | ||
| * Set `values.yaml` to run onboarder for specific modules. | ||
| * run `./install.sh`. | ||
| ``` | ||
| ./install.sh | ||
| ``` | ||
| # Troubleshootings | ||
|
|
||
| * After completion of the job, a very detailed `html report` is prepared and stored in minio as part of onboarding bucket. | ||
|
|
||
| * The user can go and view the same for more information or response messages. | ||
|
|
||
| ### Commonly found issues | ||
|
|
||
| 1. KER-ATH-401: Authentication Failed | ||
|
|
||
| Resolution: You need to provide correct secretkey for mosip-deployment-client. | ||
|
|
||
| 2. Certificate dates are not valid | ||
|
|
||
| Resolution: Check with admin regarding adding grace period in configuration. | ||
|
|
||
| 3. Upload of certificate will not be allowed to update other domain certificate | ||
|
|
||
| Resolution: This is expected when you try to upload `ida-cred` certificate twice. It should only run once and if you see this error while uploading a second time it can be ignored as the cert is already present. | ||
|
|
||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| #!/bin/bash | ||
| # Copy configmaps from other namespaces | ||
| # DST_NS: Destination namespace | ||
|
|
||
| COPY_UTIL=./copy_cm_func.sh | ||
| DST_NS=signup | ||
|
|
||
| $COPY_UTIL configmap global default $DST_NS | ||
| $COPY_UTIL configmap keycloak-env-vars keycloak $DST_NS | ||
| $COPY_UTIL configmap keycloak-host keycloak $DST_NS |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| #!/bin/sh | ||
| # Copy configmap and secret from one namespace to another. | ||
| # ./copy_cm_func.sh <resource> <configmap_name> <source_namespace> <destination_namespace> [name] | ||
| # Parameters: | ||
| # resource: configmap|secret | ||
| # name: Optional new name of the configmap or secret in destination namespace. This may be needed if there is | ||
| # clash of names | ||
|
|
||
| if [ $1 = "configmap" ] | ||
| then | ||
| RESOURCE=configmap | ||
| elif [ $1 = "secret" ] | ||
| then | ||
| RESOURCE=secret | ||
| else | ||
| echo "Incorrect resource $1. Exiting.." | ||
| exit 1 | ||
| fi | ||
|
|
||
|
|
||
| if [ $# -ge 5 ] | ||
| then | ||
| kubectl -n $4 delete --ignore-not-found=true $RESOURCE $5 | ||
| kubectl -n $3 get $RESOURCE $2 -o yaml | sed "s/namespace: $3/namespace: $4/g" | sed "s/name: $2/name: $5/g" | kubectl -n $4 create -f - | ||
| else | ||
| kubectl -n $4 delete --ignore-not-found=true $RESOURCE $2 | ||
| kubectl -n $3 get $RESOURCE $2 -o yaml | sed "s/namespace: $3/namespace: $4/g" | kubectl -n $4 create -f - | ||
| fi | ||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| #!/bin/bash | ||
| # Copy secrets from other namespaces | ||
| # DST_NS: Destination namespace | ||
|
|
||
| COPY_UTIL=./copy_cm_func.sh | ||
| DST_NS=signup | ||
|
|
||
| $COPY_UTIL secret s3 s3 $DST_NS | ||
| $COPY_UTIL secret keycloak keycloak $DST_NS | ||
| $COPY_UTIL secret keycloak-client-secrets keycloak $DST_NS |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| #!/bin/bash | ||
| # Uninstalls partner-onboarder helm | ||
| ## Usage: ./delete.sh [kubeconfig] | ||
|
|
||
| if [ $# -ge 1 ] ; then | ||
| export KUBECONFIG=$1 | ||
| fi | ||
|
|
||
| function deleting_onboarder() { | ||
| NS=signup | ||
| while true; do | ||
| read -p "Are you sure you want to delete all partner-onboarder ?(Y/n) " yn | ||
| if [ $yn = "Y" ]; then | ||
| echo Deleting signup-partner-onboarder helm | ||
| helm -n $NS delete signup-partner-onboarder | ||
| break | ||
| fi | ||
| done | ||
| return 0 | ||
| } | ||
|
|
||
| # set commands for error handling. | ||
| set -e | ||
| set -o errexit ## set -e : exit the script if any statement returns a non-true return value | ||
| set -o nounset ## set -u : exit the script if you try to use an uninitialised variable | ||
| set -o errtrace # trace ERR through 'time command' and other functions | ||
| set -o pipefail # trace ERR through pipes | ||
| deleting_onboarder # calling function |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,104 @@ | ||
| #!/bin/bash | ||
| # Onboards default partners | ||
| ## Usage: ./install.sh [kubeconfig] | ||
|
|
||
| if [ $# -ge 1 ] ; then | ||
| export KUBECONFIG=$1 | ||
| fi | ||
|
|
||
| echo "Do you have public domain & valid SSL? (Y/n) " | ||
| echo "Y: if you have public domain & valid ssl certificate" | ||
| echo "n: if you don't have a public domain and a valid SSL certificate. It will add an ssl certificate in onboarder docker. Only recommended to use in local development environments" | ||
| read -p "" flag | ||
|
|
||
| if [ -z "$flag" ]; then | ||
| echo "'flag' was provided; EXITING;" | ||
| exit 1; | ||
| fi | ||
| ENABLE_INSECURE='' | ||
| if [ "$flag" = "n" ]; then | ||
| ENABLE_INSECURE='--set onboarding.configmaps.onboarding.ENABLE_INSECURE=true'; | ||
| fi | ||
|
|
||
| NS=signup | ||
| CHART_VERSION=0.0.1-develop | ||
|
|
||
| echo Create $NS namespace | ||
| kubectl create ns $NS | ||
|
|
||
| function installing_onboarder() { | ||
|
|
||
| read -p "Is values.yaml for onboarder chart set correctly as part of Pre-requisites?(Y/n) " yn; | ||
| if [ $yn = "Y" ]; then | ||
| echo Istio label | ||
| kubectl label ns $NS istio-injection=disabled --overwrite | ||
| helm repo update | ||
|
|
||
| echo Copy configmaps | ||
| kubectl -n $NS --ignore-not-found=true delete cm s3 | ||
| kubectl -n $NS --ignore-not-found=true delete cm onboarder-namespace | ||
| sed -i 's/\r$//' copy_cm.sh | ||
| ./copy_cm.sh | ||
|
|
||
| echo Copy secrets | ||
| sed -i 's/\r$//' copy_secrets.sh | ||
| ./copy_secrets.sh | ||
|
|
||
| read -p "Provide onboarder bucket name : " s3_bucket | ||
| if [[ -z $s3_bucket ]]; then | ||
| echo "s3_bucket not provided; EXITING;"; | ||
| exit 1; | ||
| fi | ||
| if [[ $s3_bucket == *[' !@#$%^&*()+']* ]]; then | ||
| echo "s3_bucket should not contain spaces / any special character; EXITING"; | ||
| exit 1; | ||
| fi | ||
| read -p "Provide onboarder s3 bucket region : " s3_region | ||
| if [[ $s3_region == *[' !@#$%^&*()+']* ]]; then | ||
| echo "s3_region should not contain spaces / any special character; EXITING"; | ||
| exit 1; | ||
| fi | ||
|
|
||
| read -p "Provide S3 URL : " s3_url | ||
| if [[ -z $s3_url ]]; then | ||
| echo "s3_url not provided; EXITING;" | ||
| exit 1; | ||
| fi | ||
|
|
||
| s3_user_key=$( kubectl -n s3 get cm s3 -o json | jq -r '.data."s3-user-key"' ) | ||
|
|
||
| echo Onboarding default partners | ||
| helm -n $NS install signup-partner-onboarder /home/techno-376/IdeaProjects/mosip-helm/charts/partner-onboarder \ | ||
| --set image.repository=mosipdev/partner-onboarder \ | ||
| --set image.tag=develop \ | ||
| --set onboarding.configmaps.s3.s3-host="$s3_url" \ | ||
| --set onboarding.configmaps.s3.s3-user-key="$s3_user_key" \ | ||
| --set onboarding.configmaps.s3.s3-region="$s3_region" \ | ||
| --set onboarding.configmaps.s3.s3-bucket-name="$s3_bucket" \ | ||
| $ENABLE_INSECURE \ | ||
| -f values.yaml \ | ||
| --version $CHART_VERSION \ | ||
| --wait --wait-for-jobs | ||
|
|
||
| echo Updating signup-keystore-password value | ||
| kubectl -n $NS create secret generic signup-keystore-password --from-literal=signup-keystore-password='mosip123' --dry-run=client -o yaml | kubectl apply -f - | ||
| ./copy_cm_func.sh secret signup-keystore-password signup config-server | ||
|
|
||
| echo Updating signup keystore-password | ||
| kubectl -n config-server set env --keys=signup-keystore-password --from secret/signup-keystore-password deployment/config-server --prefix=SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ | ||
|
|
||
| kubectl -n config-server rollout restart deployment config-server | ||
| kubectl -n config-server rollout status deployment config-server | ||
|
|
||
| echo Reports are moved to S3 under onboarder bucket | ||
| return 0 | ||
| fi | ||
| } | ||
|
|
||
| # set commands for error handling. | ||
| set -e | ||
| set -o errexit ## set -e : exit the script if any statement returns a non-true return value | ||
| set -o nounset ## set -u : exit the script if you try to use an uninitialised variable | ||
| set -o errtrace # trace ERR through 'time command' and other functions | ||
| set -o pipefail # trace ERR through pipes | ||
| installing_onboarder # calling function |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| onboarding: | ||
| modules: | ||
| - name: ida | ||
| enabled: false | ||
| - name: print | ||
| enabled: false | ||
| - name: abis | ||
| enabled: false | ||
| - name: resident | ||
| enabled: false | ||
| - name: mobileid | ||
| enabled: false | ||
| - name: digitalcard | ||
| enabled: false | ||
| - name: esignet | ||
| enabled: false | ||
| - name: resident-oidc | ||
| enabled: false | ||
| - name: demo-oidc | ||
| enabled: false | ||
| - name: mimoto-keybinding | ||
| enabled: false | ||
| - name: mimoto-oidc | ||
| enabled: false | ||
| - name: signup-oidc | ||
| enabled: true |