Skip to content

Commit e3cd812

Browse files
ckm007ckm007
authored
[DSD-5936] (#297)
* [DSD-5936] added deployment script for keymanager and keygen Signed-off-by: ckm007 <chandrakeshavmishra@gmail.com> * [DSD-5936] added helm chart for keymanager and keygen Signed-off-by: ckm007 <chandrakeshavmishra@gmail.com> --------- Signed-off-by: ckm007 <chandrakeshavmishra@gmail.com>
1 parent 4055981 commit e3cd812

31 files changed

Lines changed: 1681 additions & 0 deletions

‎.github/workflows/chart-lint-publish.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Validate / Publish helm charts
2+
3+
on:
4+
release:
5+
types: [published]
6+
pull_request:
7+
types: [opened, reopened, synchronize]
8+
paths:
9+
- 'helm/**'
10+
workflow_dispatch:
11+
inputs:
12+
IGNORE_CHARTS:
13+
description: 'Provide list of charts to be ignored separated by pipe(|)'
14+
required: false
15+
default: '""'
16+
type: string
17+
CHART_PUBLISH:
18+
description: 'Chart publishing to gh-pages branch'
19+
required: false
20+
default: 'NO'
21+
type: string
22+
options:
23+
- YES
24+
- NO
25+
INCLUDE_ALL_CHARTS:
26+
description: 'Include all charts for Linting/Publishing (YES/NO)'
27+
required: false
28+
default: 'NO'
29+
type: string
30+
options:
31+
- YES
32+
- NO
33+
push:
34+
branches:
35+
- '!release-branch'
36+
- '!master'
37+
- 1.*
38+
- 0.*
39+
- develop
40+
- release*
41+
paths:
42+
- 'helm/**'
43+
44+
jobs:
45+
chart-lint-publish:
46+
uses: mosip/kattu/.github/workflows/chart-lint-publish.yml@master
47+
with:
48+
CHARTS_DIR: ./helm
49+
CHARTS_URL: https://mosip.github.io/mosip-helm
50+
REPOSITORY: mosip-helm
51+
BRANCH: gh-pages
52+
INCLUDE_ALL_CHARTS: "${{ inputs.INCLUDE_ALL_CHARTS || 'NO' }}"
53+
IGNORE_CHARTS: "${{ inputs.IGNORE_CHARTS || '\"\"' }}"
54+
CHART_PUBLISH: "${{ inputs.CHART_PUBLISH || 'YES' }}"
55+
LINTING_CHART_SCHEMA_YAML_URL: "https://raw.githubusercontent.com/mosip/kattu/master/.github/helm-lint-configs/chart-schema.yaml"
56+
LINTING_LINTCONF_YAML_URL: "https://raw.githubusercontent.com/mosip/kattu/master/.github/helm-lint-configs/lintconf.yaml"
57+
LINTING_CHART_TESTING_CONFIG_YAML_URL: "https://raw.githubusercontent.com/mosip/kattu/master/.github/helm-lint-configs/chart-testing-config.yaml"
58+
LINTING_HEALTH_CHECK_SCHEMA_YAML_URL: "https://raw.githubusercontent.com/mosip/kattu/master/.github/helm-lint-configs/health-check-schema.yaml"
59+
DEPENDENCIES: "mosip,https://mosip.github.io/mosip-helm;"
60+
secrets:
61+
TOKEN: ${{ secrets.ACTION_PAT }}
62+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

‎deploy/README.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Key Manager
2+
3+
## Overview
4+
[Key Manager](https://docs.mosip.io/1.2.0/modules/keymanager) runs in a separate namespace from other [Kernel modules](https://docs.mosip.io/1.2.0/modules/commons) (for security, access restrictions). Before running Key Manager, [Base keys](https://docs.mosip.io/1.2.0/modules/keymanager#key-hierarchy) need to be generated. This is done by [key generation job](https://docs.mosip.io/1.2.0/modules/keymanager#key-generation-process). The job creates Base keys in HSM/Softhsm. These keys must be kept intact throughout the project. It is assumed that HSM/Softhsm is already installed and properties in [`application-default.properties`](https://docs.mosip.io/1.2.0/modules/module-configuration#config-server) and `kernel-default.properties` are appropriately set to generate your organization's certificates.
5+
6+
## Install
7+
The key generator job and Key Manager installation is done by running the below script:
8+
```
9+
./install.sh
10+
```
11+
12+

‎deploy/copy_cm.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
# Copy configmaps from other namespaces
3+
# DST_NS: Destination (current) namespace
4+
5+
function copying_cm() {
6+
UTIL_URL=https://github.com/mosip/mosip-infra/blob/master/deployment/v3/utils/copy_cm_func.sh
7+
COPY_UTIL=./copy_cm_func.sh
8+
DST_NS=keymanager
9+
10+
wget -q $UTIL_URL -O copy_cm_func.sh && chmod +x copy_cm_func.sh
11+
12+
$COPY_UTIL configmap global default $DST_NS
13+
$COPY_UTIL configmap artifactory-share artifactory $DST_NS
14+
$COPY_UTIL configmap config-server-share config-server $DST_NS
15+
$COPY_UTIL configmap softhsm-kernel-share softhsm $DST_NS
16+
return 0
17+
}
18+
19+
# set commands for error handling.
20+
set -e
21+
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
22+
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
23+
set -o errtrace # trace ERR through 'time command' and other functions
24+
set -o pipefail # trace ERR through pipes
25+
copying_cm # calling function
26+
27+
28+

‎deploy/delete.sh‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/bash
2+
# Uninstalls keymanager
3+
## Usage: ./delete.sh [kubeconfig]
4+
5+
if [ $# -ge 1 ] ; then
6+
export KUBECONFIG=$1
7+
fi
8+
9+
function deleting_keymanager() {
10+
NS=keymanager
11+
while true; do
12+
read -p "Are you sure you want to delete keymanager helm chart?(Y/n) " yn
13+
if [ $yn = "Y" ]
14+
then
15+
helm -n $NS delete kernel-keygen
16+
helm -n $NS delete keymanager
17+
break
18+
else
19+
break
20+
fi
21+
done
22+
return 0
23+
}
24+
25+
# set commands for error handling.
26+
set -e
27+
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
28+
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
29+
set -o errtrace # trace ERR through 'time command' and other functions
30+
set -o pipefail # trace ERR through pipes
31+
deleting_keymanager # calling function

‎deploy/idle_timeout_envoyfilter.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: networking.istio.io/v1alpha3
2+
kind: EnvoyFilter
3+
metadata:
4+
name: idle-timeout-inbound-filter
5+
spec:
6+
configPatches:
7+
- applyTo: NETWORK_FILTER
8+
match:
9+
context: SIDECAR_INBOUND
10+
listener:
11+
filterChain:
12+
filter:
13+
name: envoy.filters.network.tcp_proxy
14+
patch:
15+
operation: MERGE
16+
value:
17+
name: envoy.filters.network.tcp_proxy
18+
typed_config:
19+
'@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
20+
idle_timeout: 0s

‎deploy/install.sh‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/bin/bash
2+
# Installs keymanager
3+
## Usage: ./install.sh [kubeconfig]
4+
5+
if [ $# -ge 1 ] ; then
6+
export KUBECONFIG=$1
7+
fi
8+
9+
NS=keymanager
10+
CHART_VERSION=12.1.0-develop
11+
12+
echo Creating $NS namespace
13+
kubectl create ns $NS
14+
15+
function installing_keymanager() {
16+
echo Istio label
17+
kubectl label ns $NS istio-injection=enabled --overwrite
18+
kubectl apply -n $NS -f idle_timeout_envoyfilter.yaml
19+
helm repo update
20+
21+
echo Copy configmaps
22+
sed -i 's/\r$//' copy_cm.sh
23+
./copy_cm.sh
24+
25+
echo Running keygenerator. This may take a few minutes..
26+
helm -n $NS install kernel-keygen mosip/keygen --wait --wait-for-jobs --version $CHART_VERSION -f keygen_values.yaml
27+
28+
echo Installing keymanager
29+
helm -n $NS install keymanager mosip/keymanager --version $CHART_VERSION
30+
31+
kubectl -n $NS get deploy -o name | xargs -n1 -t kubectl -n $NS rollout status
32+
echo Installed keymanager services
33+
return 0
34+
}
35+
36+
# set commands for error handling.
37+
set -e
38+
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
39+
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
40+
set -o errtrace # trace ERR through 'time command' and other functions
41+
set -o pipefail # trace ERR through pipes
42+
installing_keymanager # calling function

‎deploy/keygen_values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
springConfigNameEnv: kernel
2+
softHsmCM: softhsm-kernel-share

‎deploy/restart.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/bin/bash
2+
# Restart the keymanager
3+
## Usage: ./restart.sh [kubeconfig]
4+
5+
if [ $# -ge 1 ] ; then
6+
export KUBECONFIG=$1
7+
fi
8+
9+
function Restarting_keymanager() {
10+
NS=keymanager
11+
kubectl -n $NS rollout restart deploy keymanager
12+
13+
kubectl -n $NS get deploy -o name | xargs -n1 -t kubectl -n $NS rollout status
14+
15+
echo Restarted keymanager service
16+
return 0
17+
}
18+
19+
# set commands for error handling.
20+
set -e
21+
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
22+
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
23+
set -o errtrace # trace ERR through 'time command' and other functions
24+
set -o pipefail # trace ERR through pipes
25+
Restarting_keymanager # calling function

‎helm/keygen/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
charts/
2+
Charts.lock

‎helm/keygen/.helmignore‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*~
18+
# Various IDEs
19+
.project
20+
.idea/
21+
*.tmproj

0 commit comments

Comments
 (0)