Update owanalytics.env

https://telecominfraproject.atlassian.net/browse/WIFI-13386

.github/workflows/ci.yml

@@ -9,6 +9,7 @@ on:
     branches:
       - main
       - 'release/*'
+  workflow_dispatch: {}
 
 defaults:
   run:

chart/README.md

@@ -1,10 +1,10 @@
 # openwifi
 
-This Helm chart helps to deploy OpenWIFI Cloud SDK with all required dependencies to the Kubernetes clusters. Purpose of this chart is to setup correct connections between other microservices and other dependencies with correct Values and other charts as dependencies in [chart definition](Chart.yaml)
+This Helm chart helps to deploy OpenWIFI Cloud SDK with all required dependencies to the Kubernetes clusters. The purpose of this chart is to set up the correct connections between other microservices and other dependencies with correct Values and other charts as dependencies in [chart definition](Chart.yaml)
 
 ## TL;DR;
 
-[helm-git](https://github.com/aslafy-z/helm-git) is required for remote the installation as it pull charts from other repositories for the deployment, so intall it if you don't have it already.
+[helm-git](https://github.com/aslafy-z/helm-git) is required for remote the installation as it pull charts from other repositories for the deployment, so install it if you don't have it already.
 
 Using that you can deploy Cloud SDK with 2 setups - without TLS certificates for RESTAPI endpoints and with them.
 
@@ -20,7 +20,7 @@ $ kubectl create secret generic openwifi-certs --from-file=../docker-compose/cer
 $ helm upgrade --install -f environment-values/values.base.secure.yaml openwifi .
 ```
 
-In order to acces the UI and other RESTAPI endpoints you should run the following commands after the deployment:
+In order to access the UI and other RESTAPI endpoints you should run the following commands after the deployment:
 
 ```
 $ kubectl port-forward deployment/proxy 5912 5913 16001 16002 16003 16004 16005 16006 16009 &
@@ -43,7 +43,7 @@ $ kubectl create secret generic openwifi-certs --from-file=../docker-compose/cer
 $ helm upgrade --install -f environment-values/values.base.insecure.yaml openwifi .
 ```
 
-In order to acces the UI and other RESTAPI endpoints you should run the following commands after the deployment:
+In order to access the UI and other RESTAPI endpoints you should run the following commands after the deployment:
 
 ```
 $ kubectl port-forward deployment/proxy 5912 5913 16001 16002 16003 16004 16005 16006 16009 &
@@ -167,7 +167,7 @@ The following table lists the configurable parameters that overrides microservic
 | `restapiCerts.services` | array | List of services that require certificates generation |  |
 | `restapiCerts.clusterDomain` | string | Kubernetes cluster domain | `cluster.local` |
 
-If required, further overrides may be passed. They will be merged with default values from this chart and other subcharts with priority to values you'll pass.
+If required, further overrides may be passed. They will be merged with default values from this chart and other sub-charts with priority to values you'll pass.
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
 
@@ -200,7 +200,7 @@ By setting `clusterinfo.enabled` to `true` you may enable job on post-install/po
 1. Change default security credentials from credentials set in OWSEC configuration file (see 'Required password changing on the first startup' block above)
 2. Check if all services started responding correctly after the deployment using systeminfo REST API method
 
-In order to do that, you need to additionaly set multiple parameters:
+In order to do that, you need to additionally set multiple parameters:
 
 1. clusterinfo.public_env_variables.OWSEC - OWSEC endpoint to use for CLI tools
 2. clusterinfo.secret_env_variables.OWSEC_DEFAULT_USERNAME - username used for CLI requests (see OWSEC configuration file for details)
@@ -221,17 +221,17 @@ You may see example values to enable this feature in [values.enable-owls.yaml](.
 
 In order to use single point of entry for all services (may be used for one cloud Load Balancer per installation) HAproxy is installed by default with other services. HAproxy is working in TCP proxy mode, so every TLS certificate is managed by services themself, while it is possible to pass requests from cloud load balancer to services using same ports (configuration of cloud load balancer may vary from cloud provider to provider).
 
-By default this option is enabled, but you may disable it and make per-service LoadBalancer using values in [values.disable-haproxy.yaml](./feature-values/values.disable-haproxy.yaml).
+By default, this option is enabled, but you may disable it and make per-service LoadBalancer using values in [values.disable-haproxy.yaml](./feature-values/values.disable-haproxy.yaml).
 
 ### OWGW unsafe sysctls
 
-By default Linux is using quite adeqate sysctl values for TCP keepalive, but OWGW may keep disconnected APs in stuck state preventing it from connecting back. This may be changed by setting some sysctls to lower values:
+By default, Linux is using quite adequate sysctl values for TCP keepalive, but OWGW may keep disconnected APs in stuck state preventing it from connecting back. This may be changed by setting some sysctls to lower values:
 
 - net.ipv4.tcp_keepalive_intvl
 - net.ipv4.tcp_keepalive_probes - 2
 - net.ipv4.tcp_keepalive_time - 45
 
-However this change is [not considered safe by Kubernetes](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls) and it requires to pass additional argument to your Kubelets services in your Kubernetes cluster:
+However, this change is [not considered safe by Kubernetes](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls), and it requires to pass additional argument to your Kubelets services in your Kubernetes cluster:
 
 ```
 --allowed-unsafe-sysctls net.ipv4.tcp_keepalive_intvl,net.ipv4.tcp_keepalive_probes,net.ipv4.tcp_keepalive_time
@@ -258,16 +258,16 @@ You may see example values to enable this feature in [values.restapi-disable-tls
 
 ### PostgreSQL storage option for services
 
-By default all microservices except RRM service use SQLite as default storage driver, but it is possible to use PostgreSQL for that purpose. Both [cluster-per-microservice](environment-values/values.openwifi-qa.external-db.yaml) and [cluster per installation](environment-values/values.openwifi-qa.single-external-db.yaml) deployments method may be used.
+By default, all microservices except RRM service use SQLite as default storage driver, but it is possible to use PostgreSQL for that purpose. Both [cluster-per-microservice](environment-values/values.openwifi-qa.external-db.yaml) and [cluster per installation](environment-values/values.openwifi-qa.single-external-db.yaml) deployments method may be used.
 
 ## Environment specific values
 
-This repository contains values files that may be used in the same manner as feature values above to deploy to specific runtime envionemnts (including different cloud deployments).
+This repository contains values files that may be used in the same manner as feature values above to deploy to specific runtime environments (including different cloud deployments).
 
 Some environments are using [external-dns](https://github.com/kubernetes-sigs/external-dns) service to dynamically set DNS records, but you may manage your records manually
 
 ### AWS EKS
 
-EKS based installation assumes that you are using [AWS Load Balancer controller](https://kubernetes-sigs.github.io/aws-load-balancer-controller) so that all required ALBs and NLBs are created automatically. Also it is assumed that you have Route53 managed DNS zone and you've issued wildcard certificate for one of your zones that may be used by Load Balancers.
+EKS based installation assumes that you are using [AWS Load Balancer controller](https://kubernetes-sigs.github.io/aws-load-balancer-controller) so that all required ALBs and NLBs are created automatically. Also, it is assumed that you have Route53 managed DNS zone, and you've issued wildcard certificate for one of your zones that may be used by Load Balancers.
 
 You may see example values for this environment in [values.aws.yaml](./environment-values/values.aws.yaml).

chart/docker/change_credentials

@@ -61,7 +61,7 @@ then
         echo "Logged in with new credentials:"
     fi
 else
-    echo "Credentials check failed with unexpected ErrorCode, please review the responce body:"
+    echo "Credentials check failed with unexpected ErrorCode, please review the response body:"
     jq < ${result_file}
     exit 2
 fi

chart/environment-values/cleanup.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+[ -z "$NAMESPACE" ] && echo "No NAMESPACE set" && exit 1
+helm -n openwifi-"$NAMESPACE" delete tip-openwifi
+sleep 30
+kubectl delete ns openwifi-"$NAMESPACE"
+exit 0

chart/environment-values/deploy.sh

@@ -13,6 +13,7 @@ usage () {
   echo "- CHART_VERSION - version of chart to be deployed from assembly chart (for 'git' method git ref may be passed, for 'bundle' method version of chart may be passed)" >&2;
   echo >&2;
   echo "- VALUES_FILE_LOCATION - path to file with override values that may be used for deployment" >&2;
+  echo "- DOMAIN - Domain name. default: cicd.lab.wlan.tip.build" >&2;
   echo "- OWGW_AUTH_USERNAME - username to be used for requests to OpenWIFI Security" >&2;
   echo "- OWGW_AUTH_PASSWORD - hashed password for OpenWIFI Security (details on this may be found in https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/#authenticationdefaultpassword)" >&2;
   echo "- OWFMS_S3_SECRET - secret key that is used for OpenWIFI Firmware access to firmwares S3 bucket" >&2;
@@ -51,7 +52,7 @@ EXTRA_VALUES_SPLITTED=()
 
 # Helper functions
 check_if_chart_version_is_release() {
-  PARSED_CHART_VERSION=$(echo $CHART_VERSION | grep -xP "v\d+\.\d+\.\d+.*")
+  PARSED_CHART_VERSION=$(echo $CHART_VERSION | grep -xP "v[0-9]+\.[0-9]+\.[0-9]+.*")
   if [[ -z "$PARSED_CHART_VERSION" ]]; then
     return 1
   else
@@ -94,6 +95,7 @@ fi
 [ -z ${INTERNAL_RESTAPI_ENDPOINT_SCHEMA+x} ] && echo "INTERNAL_RESTAPI_ENDPOINT_SCHEMA is unset, setting it to 'https'" && export INTERNAL_RESTAPI_ENDPOINT_SCHEMA=https
 export MAILER_ENABLED="false"
 [ ! -z ${MAILER_USERNAME+x} ] && [ ! -z ${MAILER_PASSWORD+x} ] && echo "MAILER_USERNAME and MAILER_PASSWORD are set, mailer will be enabled" && export MAILER_ENABLED="true"
+[ -z "${DOMAIN}" ] && echo "DOMAIN is unset, using cicd.lab.wlan.tip.build" && export DOMAIN="cicd.lab.wlan.tip.build"
 
 # Transform some environment variables
 export OWGW_VERSION_TAG=$(echo ${OWGW_VERSION} | tr '/' '-')
@@ -134,14 +136,12 @@ if [[ "$DEPLOY_METHOD" == "git" ]]; then
   helm dependency update
   cd ../..
   export DEPLOY_SOURCE="wlan-cloud-ucentral-deploy/chart"
+elif [[ "$DEPLOY_METHOD" == "bundle" ]]; then
+  helm repo add tip-wlan-cloud-ucentral-helm https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/ || true
+  export DEPLOY_SOURCE="tip-wlan-cloud-ucentral-helm/openwifi --version $CHART_VERSION"
 else
-  if [[ "$DEPLOY_METHOD" == "bundle" ]]; then
-    helm repo add tip-wlan-cloud-ucentral-helm https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/ || true
-    export DEPLOY_SOURCE="tip-wlan-cloud-ucentral-helm/openwifi --version $CHART_VERSION"
-  else
-    echo "Deploy method is not correct: $DEPLOY_METHOD. Valid value - git or bundle" >&2
-    exit 1
-  fi
+  echo "Deploy method is not correct: $DEPLOY_METHOD. Valid values: git or bundle" >&2
+  exit 1
 fi
 
 VALUES_FILES_FLAGS=()
@@ -156,78 +156,28 @@ for EXTRA_VALUE in ${EXTRA_VALUES_SPLITTED[*]}; do
 done
 
 if [[ "$USE_SEPARATE_OWGW_LB" == "true" ]]; then
-  export HAPROXY_SERVICE_DNS_RECORDS="sec-${NAMESPACE}.cicd.lab.wlan.tip.build\,fms-${NAMESPACE}.cicd.lab.wlan.tip.build\,prov-${NAMESPACE}.cicd.lab.wlan.tip.build\,analytics-${NAMESPACE}.cicd.lab.wlan.tip.build\,sub-${NAMESPACE}.cicd.lab.wlan.tip.build"
-  export OWGW_SERVICE_DNS_RECORDS="gw-${NAMESPACE}.cicd.lab.wlan.tip.build"
+  export HAPROXY_SERVICE_DNS_RECORDS="sec-${NAMESPACE}.${DOMAIN},fms-${NAMESPACE}.${DOMAIN},prov-${NAMESPACE}.${DOMAIN},analytics-${NAMESPACE}.${DOMAIN},sub-${NAMESPACE}.${DOMAIN}"
+  export OWGW_SERVICE_DNS_RECORDS="gw-${NAMESPACE}.${DOMAIN}"
 else
-  export HAPROXY_SERVICE_DNS_RECORDS="gw-${NAMESPACE}.cicd.lab.wlan.tip.build\,sec-${NAMESPACE}.cicd.lab.wlan.tip.build\,fms-${NAMESPACE}.cicd.lab.wlan.tip.build\,prov-${NAMESPACE}.cicd.lab.wlan.tip.build\,analytics-${NAMESPACE}.cicd.lab.wlan.tip.build\,sub-${NAMESPACE}.cicd.lab.wlan.tip.build"
+  export HAPROXY_SERVICE_DNS_RECORDS="gw-${NAMESPACE}.${DOMAIN},sec-${NAMESPACE}.${DOMAIN},fms-${NAMESPACE}.${DOMAIN},prov-${NAMESPACE}.${DOMAIN},analytics-${NAMESPACE}.${DOMAIN},sub-${NAMESPACE}.${DOMAIN}"
   export OWGW_SERVICE_DNS_RECORDS=""
 fi
 
-# Run the deployment
+echo "Deploying into openwifi-${NAMESPACE} with the following values files:"
+echo ${VALUES_FILES_FLAGS[*]}
+echo
+envsubst < values.custom.tpl.yaml > values.custom-${NAMESPACE}.yaml
+
+echo "Using configuration:"
+echo "---"
+cat values.custom-${NAMESPACE}.yaml
+echo "---"
+set -x
 helm upgrade --install --create-namespace --wait --timeout 60m \
   --namespace openwifi-${NAMESPACE} \
   ${VALUES_FILES_FLAGS[*]} \
-  --set owgw.services.owgw.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=gw-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owgw.configProperties."openwifi\.fileuploader\.host\.0\.name"=gw-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owgw.configProperties."rtty\.server"=gw-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owgw.configProperties."openwifi\.system\.uri\.public"=https://gw-${NAMESPACE}.cicd.lab.wlan.tip.build:16002 \
-  --set owgw.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owgw-owgw:17002 \
-  --set owgw.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owgw.configProperties."iptocountry\.ipinfo\.token"="${IPTOCOUNTRY_IPINFO_TOKEN}" \
-  --set owgw.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set owsec.configProperties."authentication\.default\.username"=${OWGW_AUTH_USERNAME} \
-  --set owsec.configProperties."authentication\.default\.password"=${OWGW_AUTH_PASSWORD} \
-  --set owsec.services.owsec.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=sec-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owsec.configProperties."openwifi\.system\.uri\.public"=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set owsec.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsec-owsec:17001 \
-  --set owsec.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owsec.configProperties."mailer\.sender"=sec-${NAMESPACE}@cicd.lab.wlan.tip.build \
-  --set owsec.configProperties."mailer\.enabled"=$MAILER_ENABLED \
-  --set owsec.configProperties."mailer\.username"=$MAILER_USERNAME \
-  --set owsec.configProperties."mailer\.password"=$MAILER_PASSWORD \
-  --set owfms.configProperties."s3\.secret"=${OWFMS_S3_SECRET} \
-  --set owfms.configProperties."s3\.key"=${OWFMS_S3_KEY} \
-  --set owfms.services.owfms.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=fms-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owfms.configProperties."openwifi\.system\.uri\.public"=https://fms-${NAMESPACE}.cicd.lab.wlan.tip.build:16004 \
-  --set owfms.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owfms-owfms:17004 \
-  --set owfms.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owfms.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set owgwui.ingresses.default.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owgwui.ingresses.default.hosts={webui-${NAMESPACE}.cicd.lab.wlan.tip.build} \
-  --set owgwui.public_env_variables.REACT_APP_UCENTRALSEC_URL=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set owprov.services.owprov.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=prov-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owprov.configProperties."openwifi\.system\.uri\.public"=https://prov-${NAMESPACE}.cicd.lab.wlan.tip.build:16005 \
-  --set owprov.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owprov-owprov:17005 \
-  --set owprov.configProperties."openwifi\.system\.uri\.ui"=https://provui-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owprov.configProperties."iptocountry\.ipinfo\.token"="${IPTOCOUNTRY_IPINFO_TOKEN}" \
-  --set owprov.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set owprovui.ingresses.default.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=provui-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owprovui.ingresses.default.hosts={provui-${NAMESPACE}.cicd.lab.wlan.tip.build} \
-  --set owprovui.public_env_variables.REACT_APP_UCENTRALSEC_URL=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set owanalytics.services.owanalytics.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=analytics-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owanalytics.configProperties."openwifi\.system\.uri\.public"=https://analytics-${NAMESPACE}.cicd.lab.wlan.tip.build:16009 \
-  --set owanalytics.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owanalytics-owanalytics:17009 \
-  --set owanalytics.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owanalytics.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set owsub.services.owsub.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=sub-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owsub.configProperties."openwifi\.system\.uri\.public"=https://sub-${NAMESPACE}.cicd.lab.wlan.tip.build:16006 \
-  --set owsub.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsub-owsub:17006 \
-  --set owsub.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owsub.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set clustersysteminfo.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set clustersysteminfo.secret_env_variables.OWSEC_NEW_PASSWORD=${OWSEC_NEW_PASSWORD} \
-  --set owls.services.owls.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=ls-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owls.configProperties."openwifi\.system\.uri\.public"=https://ls-${NAMESPACE}.cicd.lab.wlan.tip.build:16007 \
-  --set owls.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owls-owls:17007 \
-  --set owls.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owlsui.ingresses.default.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=lsui-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set owlsui.ingresses.default.hosts={lsui-${NAMESPACE}.cicd.lab.wlan.tip.build} \
-  --set owlsui.public_env_variables.REACT_APP_UCENTRALSEC_URL=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set owrrm.public_env_variables.SERVICECONFIG_PUBLICENDPOINT=https://rrm-${NAMESPACE}.cicd.lab.wlan.tip.build:16789 \
-  --set owrrm.services.owrrm.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=rrm-${NAMESPACE}.cicd.lab.wlan.tip.build \
-  --set haproxy.service.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=$HAPROXY_SERVICE_DNS_RECORDS \
-  --set owgw.services.owgw.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=$OWGW_SERVICE_DNS_RECORDS \
   ${EXTRA_VALUES_FLAGS[*]} \
+  -f values.custom-${NAMESPACE}.yaml \
   --set-file owgw.certs."restapi-cert\.pem"=$CERT_LOCATION \
   --set-file owgw.certs."restapi-key\.pem"=$KEY_LOCATION \
   --set-file owgw.certs."websocket-cert\.pem"=$CERT_LOCATION \

chart/environment-values/values.aws.yaml

@@ -19,7 +19,7 @@ owgwui:
         kubernetes.io/ingress.class: alb
         alb.ingress.kubernetes.io/scheme: internet-facing
         alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285 # TODO change certificate
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
         alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
         external-dns.alpha.kubernetes.io/hostname: webui.cicd.lab.wlan.tip.build # TODO change FQDN
@@ -69,7 +69,7 @@ owprovui:
         kubernetes.io/ingress.class: alb
         alb.ingress.kubernetes.io/scheme: internet-facing
         alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285 # TODO change certificate
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
         alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
         external-dns.alpha.kubernetes.io/hostname: provui.cicd.lab.wlan.tip.build # TODO change FQDN
@@ -99,7 +99,7 @@ haproxy:
       service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
       service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "8080"
       service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285 # TODO change certificate
+      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
       service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004,16002,16003,17002,16005,17005,16001,17001,5912,5913,16009,16007"
       service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
       external-dns.alpha.kubernetes.io/hostname: "gw.cicd.lab.wlan.tip.build,sec.cicd.lab.wlan.tip.build,fms.cicd.lab.wlan.tip.build,prov.cicd.lab.wlan.tip.build,rtty.cicd.lab.wlan.tip.build,sub.cicd.lab.wlan.tip.build,analytics.cicd.lab.wlan.tip.build,rrm.cicd.lab.wlan.tip.build" # TODO change FQDNs

chart/environment-values/values.custom.tpl.yaml

@@ -0,0 +1,128 @@
+owgw:
+  services:
+    owgw:
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: "$OWGW_SERVICE_DNS_RECORDS"
+  configProperties:
+    openwifi.fileuploader.host.0.name: gw-${NAMESPACE}.${DOMAIN}
+    rtty.server: gw-${NAMESPACE}.${DOMAIN}
+    openwifi.system.uri.public: https://gw-${NAMESPACE}.${DOMAIN}:16002
+    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owgw-owgw:17002
+    openwifi.system.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
+    iptocountry.ipinfo.token: "${IPTOCOUNTRY_IPINFO_TOKEN}"
+  public_env_variables:
+    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
+owsec:
+  configProperties:
+    authentication.default.username: "${OWGW_AUTH_USERNAME}"
+    authentication.default.password: "${OWGW_AUTH_PASSWORD}"
+    openwifi.system.uri.public: https://sec-${NAMESPACE}.${DOMAIN}:16001
+    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsec-owsec:17001
+    openwifi.ystem.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
+    mailer.sender: "sec-${NAMESPACE}@${DOMAIN}"
+    mailer.enabled: $MAILER_ENABLED
+    mailer.username: "$MAILER_USERNAME"
+    mailer.password: "$MAILER_PASSWORD"
+  services:
+    owsec:
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: sec-${NAMESPACE}.${DOMAIN}
+owfms:
+  configProperties:
+    s3.secret: "${OWFMS_S3_SECRET}"
+    s3.key: "${OWFMS_S3_KEY}"
+    openwifi.system.uri.public: https://fms-${NAMESPACE}.${DOMAIN}:16004
+    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owfms-owfms:17004
+    openwifi.system.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
+  services:
+    owfms:
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: fms-${NAMESPACE}.${DOMAIN}
+  public_env_variables:
+    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
+owgwui:
+  ingresses:
+    default:
+      hosts:
+      - webui-${NAMESPACE}.${DOMAIN}
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: webui-${NAMESPACE}.${DOMAIN}
+  public_env_variables:
+    REACT_APP_UCENTRALSEC_URL: https://sec-${NAMESPACE}.${DOMAIN}:16001
+owprov:
+  services:
+    owprov:
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: prov-${NAMESPACE}.${DOMAIN}
+  configProperties:
+    openwifi.system.uri.public: https://prov-${NAMESPACE}.${DOMAIN}:16005
+    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owprov-owprov:17005
+    openwifi.system.uri.ui: https://provui-${NAMESPACE}.${DOMAIN}
+    iptocountry.ipinfo.token: "${IPTOCOUNTRY_IPINFO_TOKEN}"
+  public_env_variables:
+    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
+owprovui:
+  ingresses:
+    default:
+      hosts:
+      - provui-${NAMESPACE}.${DOMAIN}
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: provui-${NAMESPACE}.${DOMAIN}
+  public_env_variables:
+    REACT_APP_UCENTRALSEC_URL: https://sec-${NAMESPACE}.${DOMAIN}:16001
+owanalytics:
+  services:
+    owanalytics:
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: analytics-${NAMESPACE}.${DOMAIN}
+  configProperties:
+    openwifi.system.uri.public: https://analytics-${NAMESPACE}.${DOMAIN}:16009
+    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owanalytics-owanalytics:17009
+    openwifi.system.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
+  public_env_variables:
+    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
+owsub:
+  services:
+    owsub:
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: sub-${NAMESPACE}.${DOMAIN}
+  configProperties:
+    openwifi.system.uri.public: https://sub-${NAMESPACE}.${DOMAIN}:16006
+    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsub-owsub:17006
+    openwifi.system.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
+  public_env_variables:
+    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
+clustersysteminfo:
+  public_env_variables:
+    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
+  secret_env_variables:
+    OWSEC_NEW_PASSWORD: "${OWSEC_NEW_PASSWORD}"
+owls:
+  services:
+    owls:
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: ls-${NAMESPACE}.${DOMAIN}
+  configProperties:
+    openwifi.system.uri.public: https://ls-${NAMESPACE}.${DOMAIN}:16007
+    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owls-owls:17007
+    openwifi.system.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
+owlsui:
+  ingresses:
+    default:
+      hosts:
+      - lsui-${NAMESPACE}.${DOMAIN}
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: lsui-${NAMESPACE}.${DOMAIN}
+  public_env_variables:
+    REACT_APP_UCENTRALSEC_URL: https://sec-${NAMESPACE}.${DOMAIN}:16001
+owrrm:
+  public_env_variables:
+    SERVICECONFIG_PUBLICENDPOINT: https://rrm-${NAMESPACE}.${DOMAIN}:16789
+  services:
+    owrrm:
+      annotations:
+        external-dns.alpha.kubernetes.io/hostname: rrm-${NAMESPACE}.${DOMAIN}
+haproxy:
+  service:
+    annotations:
+      external-dns.alpha.kubernetes.io/hostname: "$HAPROXY_SERVICE_DNS_RECORDS"

chart/environment-values/values.openwifi-qa.owls-enabled.yaml

@@ -1,3 +1,4 @@
+# This helm values file is to be used when OWLS is run in the same namespace.
 owgw:
   services:
     owgw:
@@ -7,7 +8,7 @@ owgw:
         service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
         service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16102"
         service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003,17002"
 
   configProperties:
@@ -30,7 +31,6 @@ owgw:
   postgresql:
     enabled: true
     fullnameOverride: owgw-pgsql
-
     postgresqlDatabase: owgw
     postgresqlUsername: owgw
     postgresqlPassword: owgw
@@ -46,7 +46,7 @@ owls:
         service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
         service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16107"
         service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16007,17007"
         external-dns.alpha.kubernetes.io/ttl: "60"
 
@@ -162,7 +162,145 @@ owlsui:
         kubernetes.io/ingress.class: alb
         alb.ingress.kubernetes.io/scheme: internet-facing
         alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
+        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
+        alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
+        external-dns.alpha.kubernetes.io/ttl: "60"
+      paths:
+      - path: /*
+        serviceName: owlsui
+        servicePort: http
+
+  podAnnotations:
+    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
+owls:
+  enabled: true
+
+  services:
+    owls:
+      type: LoadBalancer
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-type: "nlb-ip"
+        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16107"
+        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
+        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16007,17007"
+        external-dns.alpha.kubernetes.io/ttl: "60"
+
+  podAnnotations:
+    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
+
+  resources:
+    requests:
+      cpu: 6000m
+      memory: 8000Mi
+    limits:
+      cpu: 6000m
+      memory: 8000Mi
+
+  checks:
+    owls:
+      liveness:
+        httpGet:
+          path: /
+          port: 16107
+        failureThreshold: 900
+      readiness:
+        httpGet:
+          path: /
+          port: 16107
+        failureThreshold: 900
+
+  certs:
+    restapi-ca.pem: |
+      -----BEGIN CERTIFICATE-----
+      MIIDojCCAoqgAwIBAgIUPVYBpqNbcLYygF6Mx+qxSWwQyFowDQYJKoZIhvcNAQEL
+      BQAwaTELMAkGA1UEBhMCVVMxJDAiBgNVBAoTG1RlbGVjb20gSW5mcmEgUHJvamVj
+      dCwgSW5jLjEMMAoGA1UECxMDVElQMSYwJAYDVQQDEx1UZWxlY29tIEluZnJhIFBy
+      b2plY3QgUm9vdCBDQTAeFw0yMTA0MTMyMjQyNDRaFw0zMTA0MTMyMjM4NDZaMGkx
+      CzAJBgNVBAYTAlVTMSQwIgYDVQQKExtUZWxlY29tIEluZnJhIFByb2plY3QsIElu
+      Yy4xDDAKBgNVBAsTA1RJUDEmMCQGA1UEAxMdVGVsZWNvbSBJbmZyYSBQcm9qZWN0
+      IFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIGCibwf5u
+      AAwZ+1H8U0e3u2V+0d2gSctucoK86XwUmfe1V2a/qlCYZd29r80IuN1IIeB0naIm
+      KnK/MzXW87clF6tFd1+HzEvmlY/W4KyIXalVCTEzirFSvBEG2oZpM0yC3AefytAO
+      aOpA00LaM3xTfTqMKIRhJBuLy0I4ANUVG6ixVebbGuc78IodleqiLoWy2Q9QHyEO
+      t/7hZndJhiVogh0PveRhho45EbsACu7ymDY+JhlIleevqwlE3iQoq0YcmYADHno6
+      Eq8vcwLpZFxihupUafkd1T3WJYQAJf9coCjBu2qIhNgrcrGD8R9fGswwNRzMRMpX
+      720+GjcDW3bJAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFAJG
+      lmB5sVP2qfL3xZ8hQOTpkQH6MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsF
+      AAOCAQEAVjl9dm4epG9NUYnagT9sg7scVQEPfz3Lt6w1NXJXgD8mAUlK0jXmEyvM
+      dCPD4514n+8+lM7US8fh+nxc7jO//LwK17Wm9FblgjNFR7+anv0Q99T9fP19DLlF
+      PSNHL2emogy1bl1lLTAoj8nxg2wVKPDSHBGviQ5LR9fsWUIJDv9Bs5k0qWugWYSj
+      19S6qnHeskRDB8MqRLhKMG82oDVLerSnhD0P6HjySBHgTTU7/tYS/OZr1jI6MPbG
+      L+/DtiR5fDVMNdBSGU89UNTi0wHY9+RFuNlIuvZC+x/swF0V9R5mN+ywquTPtDLA
+      5IOM7ItsRmen6u3qu+JXros54e4juQ==
+      -----END CERTIFICATE-----
+
+  public_env_variables:
+    SELFSIGNED_CERTS: "true"
+
+  configProperties:
+    openwifi.internal.restapi.host.0.rootca: $OWLS_ROOT/certs/restapi-certs/ca.crt
+    openwifi.internal.restapi.host.0.cert: $OWLS_ROOT/certs/restapi-certs/tls.crt
+    openwifi.internal.restapi.host.0.key: $OWLS_ROOT/certs/restapi-certs/tls.key
+    openwifi.restapi.host.0.rootca: $OWLS_ROOT/certs/restapi-certs/ca.crt
+    openwifi.restapi.host.0.cert: $OWLS_ROOT/certs/restapi-certs/tls.crt
+    openwifi.restapi.host.0.key: $OWLS_ROOT/certs/restapi-certs/tls.key
+
+  volumes:
+    owls:
+      - name: config
+        mountPath: /owls-data/owls.properties
+        subPath: owls.properties
+        # Template below will be rendered in template
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owls.fullname" . }}-config
+      - name: certs
+        mountPath: /owls-data/certs
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owls.fullname" . }}-certs
+      - name: certs-cas
+        mountPath: /owls-data/certs/cas
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owls.fullname" . }}-certs-cas
+      # Change this if you want to use another volume type
+      - name: persist
+        mountPath: /owls-data/persist
+        volumeDefinition: |
+          persistentVolumeClaim:
+            claimName: {{ template "owls.fullname" . }}-pvc
+
+      - name: restapi-certs
+        mountPath: /owls-data/certs/restapi-certs
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owls.fullname" . }}-owls-restapi-tls
+      - name: restapi-ca
+        mountPath: /usr/local/share/ca-certificates/restapi-ca-selfsigned.crt
+        subPath: ca.crt
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owls.fullname" . }}-owls-restapi-tls
+
+owlsui:
+  enabled: true
+
+  services:
+    owlsui:
+      type: NodePort
+
+  ingresses:
+    default:
+      enabled: true
+      annotations:
+        kubernetes.io/ingress.class: alb
+        alb.ingress.kubernetes.io/scheme: internet-facing
+        alb.ingress.kubernetes.io/group.name: wlan-cicd
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
         alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
         external-dns.alpha.kubernetes.io/ttl: "60"

chart/environment-values/values.openwifi-qa.owls-external.yaml

@@ -0,0 +1,36 @@
+# This helm values file is to be used when OWLS is run externally.
+owgw:
+  services:
+    owgw:
+      type: LoadBalancer
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-type: "nlb-ip"
+        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16102"
+        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
+        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003,17002"
+
+  configProperties:
+    simulatorid: 53494D020202
+    storage.type: postgresql
+    storage.type.postgresql.host: owgw-pgsql
+    storage.type.postgresql.database: owgw
+    storage.type.postgresql.username: owgw
+    storage.type.postgresql.password: owgw
+    openwifi.certificates.allowmismatch: "true"
+
+  resources:
+    requests:
+      cpu: 2000m
+      memory: 3000Mi
+    limits:
+      cpu: 2000m
+      memory: 3000Mi
+
+  postgresql:
+    enabled: true
+    fullnameOverride: owgw-pgsql
+    postgresqlDatabase: owgw
+    postgresqlUsername: owgw
+    postgresqlPassword: owgw

chart/environment-values/values.openwifi-qa.separate-lbs.yaml

@@ -7,7 +7,7 @@ owgw:
         service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
         service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16102"
         service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003,17002,5912,5913"
 
 owsec:
@@ -19,7 +19,7 @@ owsec:
         service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
         service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16101"
         service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16001,17001"
 
 owfms:
@@ -31,7 +31,7 @@ owfms:
         service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
         service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16104"
         service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004"
 
 owprov:
@@ -43,7 +43,7 @@ owprov:
         service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
         service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16105"
         service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16005,17005"
 
 owanalytics:
@@ -55,7 +55,7 @@ owanalytics:
         service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
         service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16109"
         service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16009,17009"
 
 owsub:
@@ -67,7 +67,7 @@ owsub:
         service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
         service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16106"
         service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16006,17006"
 
 haproxy:

chart/environment-values/values.openwifi-qa.single-external-db.yaml

@@ -1,5 +1,6 @@
 owgw:
   configProperties:
+    simulatorid: 53494D020202
     storage.type: postgresql
     storage.type.postgresql.host: pgsql-pgpool
     storage.type.postgresql.database: owgw
@@ -61,11 +62,12 @@ postgresql-ha:
         memory: 1024Mi
     initdbScriptsSecret: tip-openwifi-initdb-scripts
   postgresql:
-    replicaCount: 1 # TODO change after tests
-    password: password
+    replicaCount: 1
+    password: postgres
     postgresPassword: postgres
     repmgrPassword: repmgr
     maxConnections: 1000
+
     resources:
       requests:
         cpu: 250m

chart/environment-values/values.openwifi-qa.yaml

@@ -17,20 +17,20 @@ owgw:
       cpu: 2000m
       memory: 2Gi
 
-  securityContext:
-    sysctls:
-    - name: net.ipv4.tcp_keepalive_intvl
-      value: "5"
-    - name: net.ipv4.tcp_keepalive_probes
-      value: "2"
-    - name: net.ipv4.tcp_keepalive_time
-      value: "45"
+#  securityContext:
+#    sysctls:
+#    - name: net.ipv4.tcp_keepalive_intvl
+#      value: "5"
+#    - name: net.ipv4.tcp_keepalive_probes
+#      value: "2"
+#    - name: net.ipv4.tcp_keepalive_time
+#      value: "45"
 
   podAnnotations:
     cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
 
-  podSecurityPolicy:
-    enabled: true
+#  podSecurityPolicy:
+#    enabled: true
 
   certs:
     restapi-ca.pem: |
@@ -360,7 +360,7 @@ owgwui:
         kubernetes.io/ingress.class: alb
         alb.ingress.kubernetes.io/scheme: internet-facing
         alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
         alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
       paths:
@@ -425,6 +425,7 @@ owfms:
 
   public_env_variables:
     SELFSIGNED_CERTS: "true"
+    # This has no effect as template based config is not enabled (see configProperties)
     FIRMWAREDB_MAXAGE: "360"
 
   configProperties:
@@ -434,6 +435,7 @@ owfms:
     openwifi.restapi.host.0.rootca: $OWFMS_ROOT/certs/restapi-certs/ca.crt
     openwifi.restapi.host.0.cert: $OWFMS_ROOT/certs/restapi-certs/tls.crt
     openwifi.restapi.host.0.key: $OWFMS_ROOT/certs/restapi-certs/tls.key
+    firmwaredb.maxage: 360
 
   volumes:
     owfms:
@@ -566,7 +568,7 @@ owprovui:
         kubernetes.io/ingress.class: alb
         alb.ingress.kubernetes.io/scheme: internet-facing
         alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
         alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
         alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
       paths:
@@ -754,8 +756,8 @@ owrrm:
         service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
         service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16789"
         service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16789,17007"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16789,16790"
 
   resources:
     requests:
@@ -854,8 +856,8 @@ haproxy:
       service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
       service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "8080"
       service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
-      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004,16002,16003,17002,16005,17005,5913,16001,17001,16009,16007,16006,17006"
+      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
+      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004,16002,16003,17002,16005,17005,5913,16001,17001,16009,16006,17006"
       service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
 
 restapiCerts:

chart/templates/secret-postgresql-initdb.yaml

@@ -1,10 +1,10 @@
 {{- $root := . -}}
-{{- if index .Values "postgresql-ha" "initDbScriptSecret" "enabled" }}
+{{- if  index .Values "postgresql-ha" "initDbScriptSecret" "enabled" }}
 ---
 apiVersion: v1
 metadata:
   labels:
-    app.kuberentes.io/name: {{ include "openwifi.name" . }}
+    app.kubernetes.io/name: {{ include "openwifi.name" . }}
     helm.sh/chart: {{ include "openwifi.chart" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}

docker-compose/.env

@@ -8,7 +8,7 @@ OWPROV_TAG=main
 OWPROVUI_TAG=main
 OWANALYTICS_TAG=main
 OWSUB_TAG=main
-KAFKA_TAG=latest
+KAFKA_TAG=2.8.0-debian-10-r43
 ZOOKEEPER_TAG=3.8
 POSTGRESQL_TAG=15.0
 MYSQL_TAG=latest

docker-compose/.env.letsencrypt

@@ -9,7 +9,7 @@ OWPROVUI_TAG=main
 OWANALYTICS_TAG=main
 OWSUB_TAG=main
 OWRRM_TAG=main
-KAFKA_TAG=latest
+KAFKA_TAG=2.8.0-debian-10-r43
 ZOOKEEPER_TAG=3.8
 ACMESH_TAG=latest
 TRAEFIK_TAG=latest

docker-compose/.env.selfsigned

@@ -9,7 +9,7 @@ OWPROVUI_TAG=main
 OWANALYTICS_TAG=main
 OWSUB_TAG=main
 OWRRM_TAG=main
-KAFKA_TAG=latest
+KAFKA_TAG=2.8.0-debian-10-r43
 ZOOKEEPER_TAG=3.8
 ACMESH_TAG=latest
 TRAEFIK_TAG=latest

docker-compose/docker-compose.postgresql.yml

@@ -39,6 +39,12 @@ services:
     image: "postgres:${POSTGRESQL_TAG}"
     networks:
       openwifi:
+    command:
+      - "postgres"
+      - "-c"
+      - "max_connections=400"
+      - "-c"
+      - "shared_buffers=20MB"    
     env_file:
       - postgresql.env
     restart: unless-stopped

docker-compose/kafka.env

@@ -1,3 +1,3 @@
 KAFKA_CFG_ZOOKEEPER_CONNECT=zookeeper:2181
 ALLOW_PLAINTEXT_LISTENER=yes
-TOPICS=command connection device_event_queue device telemetry healthcheck provisioning_change service_events state wifiscan
+TOPICS=command connection device_event_queue device telemetry healthcheck provisioning_change service_events state wifiscan rrm

docker-compose/owanalytics.env

@@ -27,11 +27,12 @@ SYSTEM_URI_UI=https://openwifi.wlan.local
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
 #STORAGE_TYPE=sqlite
-#STORAGE_TYPE_POSTGRESQL_HOST=localhost
-#STORAGE_TYPE_POSTGRESQL_USERNAME=owanalytics
-#STORAGE_TYPE_POSTGRESQL_PASSWORD=owanalytics
-#STORAGE_TYPE_POSTGRESQL_DATABASE=owanalytics
-#STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE=postgresql
+STORAGE_TYPE_POSTGRESQL_HOST=postgresql
+STORAGE_TYPE_POSTGRESQL_USERNAME=owanalytics
+STORAGE_TYPE_POSTGRESQL_PASSWORD=owanalytics
+STORAGE_TYPE_POSTGRESQL_DATABASE=owanalytics
+STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owanalytics
 #STORAGE_TYPE_MYSQL_PASSWORD=owanalytics

docker-compose/owls/.env

@@ -3,7 +3,7 @@ COMPOSE_PROJECT_NAME=owls
 OWSEC_TAG=main
 OWLS_TAG=main
 OWLSUI_TAG=master
-KAFKA_TAG=latest
+KAFKA_TAG=2.8.0-debian-10-r43
 ZOOKEEPER_TAG=latest
 
 # Microservice root/config directories