Set fixed PostgreSQL image version tag

Signed-off-by: Johann Hoffmann <johann.hoffmann@mailbox.org>

.github/git-release-tool/git-release-tool.sh

@@ -0,0 +1,353 @@
+#!/bin/bash
+set -e
+
+# git-release-tool
+# This script is used to manually cut releases for the TIP OpenWIFI CloudSDK 2.x repos
+# For other details, see "usage" function or simply run script
+
+# Constants
+export PAGER=cat
+
+# Internal vars
+LOG_VERBOSITY_NUMBER=0
+REPO_TAGS_ARRAY=()
+
+# Helper functions
+## Logging functions
+log_notice() {
+  echo "[Notice] "$1
+}
+
+log_error() {
+  if [[ "$LOG_VERBOSITY_NUMBER" -ge 0 ]]; then
+    echo "[Error] "$1 >/dev/stderr
+  fi
+}
+
+log_info() {
+  if [[ "$LOG_VERBOSITY_NUMBER" -ge 1 ]]; then
+    echo "[Info] "$1
+  fi
+}
+
+log_debug() {
+  if [[ "$LOG_VERBOSITY_NUMBER" -ge 2 ]]; then
+    echo "[Debug] "$1
+  fi
+}
+
+## Usage info
+usage() {
+  echo
+  log_notice "$0 - script to cut releases for TIP OpenWIFI CloudSDK 2.x repos"
+  log_notice
+  log_notice "This script requires configuration file 'repositories.yaml' near the script and list of environment variables to work"
+  log_notice
+  log_notice "repositories.yaml file format:"
+  echo "deploy_repo_url: git@github.com:Telecominfraproject/wlan-cloud-ucentral-deploy.git # modify if repo name changes"
+  echo "repositories:"
+  echo "  - name: owgw-ui # should be the same as in image repository in helm values (i.e. tip-tip-wlan-cloud-ucentral.jfrog.io/owgw-ui)"
+  echo "    url: git@github.com:Telecominfraproject/wlan-cloud-owprov-ui.git # it's up to you to use SSH or HTTPS format and setup credentials for push/pull"
+  echo "    docker_compose_name: OWPROVUI # name of environment variable in docker-compose .env file containing image tag for the service"
+  log_notice
+  log_notice "List of required environment variables:"
+  log_notice "- RELEASE_VERSION - release version that should be applied to repositories. Should comply release nameing policy (valid example - 'v2.0.0')"
+  log_notice "- TAG_TYPE - type of tag that should be created for release (supported values - RC / FINAL)"
+  log_notice "- GIT_PUSH_CONFIRMED - confirmation that any changes should be pushed to git (dry-run if unset, set to 'true' to enable)"
+  log_notice
+  log_notice "You may increase log verbosity by setting environment variable LOG_VERBOSITY to required level (ERROR/INFO/DEBUG)"
+#
+}
+
+## Setting functions
+set_log_verbosity_number() {
+  # Log verbosity levels:
+  # 0 - ERROR
+  # 1 - INFO
+  # 2 - DEBUG
+  case $LOG_VERBOSITY in
+    ERROR )
+      LOG_VERBOSITY_NUMBER=0
+    ;;
+    INFO )
+      LOG_VERBOSITY_NUMBER=1
+    ;;
+    DEBUG )
+      LOG_VERBOSITY_NUMBER=2
+    ;;
+    * )
+      log_notice "Setting LOG_VERBOSITY to INFO by default"
+      LOG_VERBOSITY_NUMBER=1
+    ;;
+  esac
+}
+
+## Git manipulation functions
+modify_deploy_repo_values() {
+  NEW_RELEASE_TAG=$1
+  log_debug "NEW_RELEASE_TAG - $NEW_RELEASE_TAG"
+  REPOSITORIES_AMOUNT=$(cat ../repositories.yaml | yq ".repositories[].name" -r | wc -l)
+  for REPO_INDEX in $(seq 0 $(expr $REPOSITORIES_AMOUNT - 1)); do
+    REPO_URL=$(cat ../repositories.yaml | yq ".repositories[$REPO_INDEX].url" -r)
+    REPO_NAME_SUFFIXED=$(echo $REPO_URL | awk -F '/' '{print $NF}')
+    REPO_NAME_WITHOUT_SUFFIX=${REPO_NAME_SUFFIXED%.git}
+    REPO_DOCKER_COMPOSE_NAME=$(cat ../repositories.yaml | yq ".repositories[$REPO_INDEX].docker_compose_name" -r)
+    SERVICE_TAG="${REPO_TAGS_ARRAY[$REPO_INDEX]}"
+    log_debug "REPO_NAME_WITHOUT_SUFFIX - $REPO_NAME_WITHOUT_SUFFIX"
+    sed "s/$REPO_DOCKER_COMPOSE_NAME=.*/$REPO_DOCKER_COMPOSE_NAME=$SERVICE_TAG/" -i docker-compose/.env
+    sed "s/$REPO_DOCKER_COMPOSE_NAME=.*/$REPO_DOCKER_COMPOSE_NAME=$SERVICE_TAG/" -i docker-compose/.env.letsencrypt
+    sed "s/$REPO_DOCKER_COMPOSE_NAME=.*/$REPO_DOCKER_COMPOSE_NAME=$SERVICE_TAG/" -i docker-compose/.env.selfsigned
+    sed "/${REPO_NAME_WITHOUT_SUFFIX#*/}@/s/ref=.*/ref=$SERVICE_TAG\"/g" -i chart/Chart.yaml
+  done
+  LATEST_RELEASE_TAG=$(git tag | grep $CURRENT_RELEASE_VERSION | tail -1)
+  if [[ "$(git diff | wc -l)" -eq "0" ]] && [[ "$(git diff $LATEST_RELEASE_TAG)" -eq "0" ]]; then
+    log_info "No changes in microservices and since the latest tag are found, new release is not required"
+  else
+    sed 's/^version: .*/version: '${NEW_RELEASE_TAG#v}'/' chart/Chart.yaml -i
+    if [[ "$GIT_PUSH_CONFIRMED" == "true" ]]; then
+      log_info "Updating helm dependencies:"
+      cd chart
+      helm dependency update
+      cd ..
+    else
+      log_info "Skipping helm charts update due to GIT_PUSH_CONFIRMED not being set to 'true'"
+    fi
+  fi
+  git diff
+}
+
+modify_values() {
+  NEW_RELEASE_TAG=$1
+  if [[ "$(basename $PWD)" == "deploy" ]]; then
+    modify_deploy_repo_values $NEW_RELEASE_TAG
+  else
+    sed "/repository: tip-tip-wlan-cloud-ucentral.jfrog.io\/$(basename $PWD)/!b;n;s/tag: .*/tag: $NEW_RELEASE_TAG/" -i helm/values.yaml
+  fi
+  if [[ "$LOG_VERBOSITY_NUMBER" -ge 2 ]]; then
+    log_debug "Diff to me commited:"
+    git diff
+  fi
+  git add .
+  git commit -m"Chg: update image tag in helm values to $NEW_RELEASE_TAG"
+}
+
+push_changes() {
+  CURRENT_RELEASE=$(git rev-parse --abbrev-ref HEAD)
+  if [[ "$GIT_PUSH_CONFIRMED" == "true" ]]; then
+    log_info "Pushing branch changes and tags:"
+    git push -u origin $CURRENT_RELEASE
+    git push --tags
+  else
+    log_info "Skipping pushing of branch and tags due to GIT_PUSH_CONFIRMED not being set to 'true'"
+  fi
+}
+
+create_tag() {
+  CURRENT_RELEASE_VERSION=$(git rev-parse --abbrev-ref HEAD | awk -F 'release/' '{print $2}')
+  TAG_TYPE_LOWERED=$(echo $TAG_TYPE | tr '[:upper:]' '[:lower:]')
+  if [[ "$TAG_TYPE_LOWERED" == "final" ]]; then
+    log_debug "Creating final tag"
+    modify_values $CURRENT_RELEASE_VERSION
+    git tag $CURRENT_RELEASE_VERSION
+    push_changes
+    REPO_TAGS_ARRAY+=($CURRENT_RELEASE_VERSION)
+  else
+    log_debug "Checking if there are tags in the current release branch"
+    LATEST_RELEASE_TAG=$(git tag | grep $CURRENT_RELEASE_VERSION | tail -1)
+    log_debug "Latest release tag found - '$LATEST_RELEASE_TAG'"
+    if [[ -z "$LATEST_RELEASE_TAG" ]]; then
+      log_info "There are no tags in the release branch, creating the first one"
+      NEW_RELEASE_TAG=$CURRENT_RELEASE_VERSION-RC1
+      log_debug "New tag - $NEW_RELEASE_TAG"
+      modify_values $NEW_RELEASE_TAG
+      git tag $NEW_RELEASE_TAG
+      push_changes
+      REPO_TAGS_ARRAY+=($NEW_RELEASE_TAG)
+    else
+      if [[ "$(basename $PWD)" == "deploy" ]]; then
+        NEW_RC=$(echo $LATEST_RELEASE_TAG | awk -F 'RC' '{print $2}')
+        NEW_RC=$(expr $NEW_RC + 1)
+        log_debug "New RC to create - $NEW_RC"
+        NEW_RELEASE_TAG=$CURRENT_RELEASE_VERSION-RC$NEW_RC
+        modify_deploy_repo_values $NEW_RELEASE_TAG
+        if [[ "v$(cat chart/Chart.yaml | yq '.version' -r)" == "$NEW_RELEASE_TAG" ]]; then
+          git add .
+          git commit -m"Chg: update image tag in helm values to $NEW_RELEASE_TAG"
+          git tag $NEW_RELEASE_TAG
+          push_changes
+          log_info "New tag $NEW_RELEASE_TAG was created and pushed"
+          REPO_TAGS_ARRAY+=($NEW_RELEASE_TAG)
+        else
+          log_info "New tag for deploy repo is not required, saving existing one ($LATEST_RELEASE_TAG)"
+          REPO_TAGS_ARRAY+=($LATEST_RELEASE_TAG)
+        fi
+      else
+        log_debug "Checking if the latest tag is on the latest commit"
+        LATEST_REVISION=$(git rev-parse HEAD)
+        LATEST_RELEASE_TAG_REVISION=$(git rev-parse $LATEST_RELEASE_TAG)
+        log_debug "Latest revision ----- $LATEST_REVISION"
+        log_debug "Latest tag revision - $LATEST_RELEASE_TAG_REVISION"
+        if [[ "$LATEST_REVISION" == "$LATEST_RELEASE_TAG_REVISION" ]]; then
+          log_info "Existing tag $LATEST_RELEASE_TAG is pointing to the latest commit in the release branch"
+          REPO_TAGS_ARRAY+=($LATEST_RELEASE_TAG)
+        else
+          NEW_RC=$(echo $LATEST_RELEASE_TAG | awk -F 'RC' '{print $2}')
+          NEW_RC=$(expr $NEW_RC + 1)
+          log_debug "New RC to create - $NEW_RC"
+          NEW_RELEASE_TAG=$CURRENT_RELEASE_VERSION-RC$NEW_RC
+          modify_values $NEW_RELEASE_TAG
+          git tag $NEW_RELEASE_TAG
+          push_changes
+          log_info "New tag $NEW_RELEASE_TAG was created and pushed"
+          REPO_TAGS_ARRAY+=($NEW_RELEASE_TAG)
+        fi
+      fi
+    fi
+  fi
+}
+
+check_final_tag() {
+  CURRENT_RELEASE_VERSION=$(git rev-parse --abbrev-ref HEAD | awk -F 'release/' '{print $2}')
+  log_debug "Amount of final tags found - $(git tag | grep -x $CURRENT_RELEASE_VERSION | wc -l)"
+  if [[ "$(git tag | grep -x $CURRENT_RELEASE_VERSION | wc -l)" -gt "0" ]]; then
+    log_error "Final tag $CURRENT_RELEASE_VERSION already exists in release branch"
+    exit 1
+  fi
+}
+
+check_git_tags() {
+  CURRENT_RELEASE_VERSION=$(git rev-parse --abbrev-ref HEAD | awk -F 'release/' '{print $2}')
+  RELEASE_TAGS_AMOUNT=$(git tag | grep $CURRENT_RELEASE_VERSION | wc -l)
+  log_debug "Amount of tags linked with the release - $RELEASE_TAGS_AMOUNT"
+  if [[ "$RELEASE_TAGS_AMOUNT" -gt "0" ]]; then
+    check_final_tag
+  fi
+  create_tag
+}
+
+check_release_branch() {
+  RELEASE_BRANCH=$1
+  git checkout $RELEASE_BRANCH -q
+  check_git_tags
+}
+
+create_release_branch() {
+  git checkout -b release/$RELEASE_VERSION -q
+  check_release_branch release/$RELEASE_VERSION
+}
+
+check_if_release_branch_required() {
+  LATEST_RELEASE_BRANCH=$(git branch -r | grep 'release/' | tail -1 | xargs)
+  log_debug "Latest release branch available - $LATEST_RELEASE_BRANCH"
+  if [[ -z "$LATEST_RELEASE_BRANCH" ]]; then
+    log_info "Could not find a single release branch, creating it"
+    create_release_branch $RELEASE_VERSION
+  else
+    LAST_RELEASE_DIFF_LINES_AMOUNT=$(git diff $LATEST_RELEASE_BRANCH ':(exclude)helm/values.yaml' | wc -l)
+    if [[ "$LAST_RELEASE_DIFF_LINES_AMOUNT" -eq "0" ]]; then
+      log_info "There are no changes in project since the latest release branch $LATEST_RELEASE_BRANCH so we will use tag from it"
+      LATEST_RELEASE=$(echo $LATEST_RELEASE_BRANCH | awk -F 'origin/' '{print $2}')
+      LATEST_RELEASE_TAG=$(git tag | grep -x $LATEST_RELEASE | tail -1)
+      if [[ -z "$LATEST_RELEASE_TAG" ]]; then
+        log_info "Could not find any tags for $LATEST_RELEASE release, creating it"
+        check_release_branch $LATEST_RELEASE
+      else
+        log_info "Latest release tag found - $LATEST_RELEASE_TAG"
+        REPO_TAGS_ARRAY+=($LATEST_RELEASE_TAG)
+      fi 
+    else
+      create_release_branch $RELEASE_VERSION
+    fi
+  fi
+}
+
+create_repo_version() {
+  CWD=$PWD
+  REPO_NAME=$1
+  REPO_URL=$2
+  rm -rf $REPO_NAME
+  git clone -q $REPO_URL $REPO_NAME
+  cd $REPO_NAME
+  DEFAULT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
+  RELEASE_BRANCH=$(git branch -r | grep $RELEASE_VERSION | awk -F 'origin/' '{print $2}' | xargs)
+  log_debug "Release branch to check - '$RELEASE_BRANCH'"
+  if [[ ! -z "$RELEASE_BRANCH" ]]; then
+    log_info "Release branch $RELEASE_BRANCH exists in the repository, checking if it has tags"
+    check_release_branch $RELEASE_BRANCH
+  else
+    log_info "Release branch does not exists in the repository, checking if we need to create it"
+    check_if_release_branch_required $DEFAULT_BRANCH
+  fi
+  log_info "Release commit info:"
+  git show
+  cd $CWD
+  rm -rf $REPO_NAME
+}
+
+# Log level setup
+set_log_verbosity_number
+
+# Check system requirements
+if ! command -v yq &> /dev/null; then
+    log_error "Command yq could not be found"
+    usage
+    exit 2
+fi
+if ! command -v sed &> /dev/null; then
+    log_error "Command sed could not be found"
+    usage
+    exit 2
+fi
+if ! command -v helm &> /dev/null; then
+    log_error "Command helm could not be found"
+    usage
+    exit 2
+fi
+if [[ "$(helm plugin list | grep -wP '(helm-git|diff)' | wc -l)" -ne "2" ]]; then
+    log_error "Helm plugins (helm-git and/or diff) are missing"
+    usage
+    exit 2
+fi
+
+# Check variables
+log_debug "Release version: ${RELEASE_VERSION}"
+[ -z ${RELEASE_VERSION+x} ] && echo "RELEASE_VERSION is unset" && usage && exit 3
+echo "${RELEASE_VERSION}" | grep -xP "v(\d)+\.(\d)+\.\d+" >/dev/null || (log_error "RELEASE_VERSION is not in the right notation (correct example - v2.2.0)" && usage && exit 3)
+log_debug "Tag type: ${TAG_TYPE}"
+[ -z ${TAG_TYPE+x} ] && echo "TAG_TYPE is unset" && usage && exit 3
+echo "${TAG_TYPE}" | tr '[:upper:]' '[:lower:]' | grep -xP "(rc|final)" >/dev/null || (log_error "TAG_TYPE is not in the supported values ('rc' or 'final', case insensitive)" && usage && exit 3)
+
+# Main body
+REPOSITORIES_AMOUNT=$(cat repositories.yaml | yq ".repositories[].name" -r | wc -l)
+DEPLOY_REPO_URL=$(cat repositories.yaml | yq ".deploy_repo_url" -r)
+log_debug "DEPLOY_REPO_URL - $DEPLOY_REPO_URL"
+
+log_info "Checking repositories"
+log_info "Found $REPOSITORIES_AMOUNT repos to process"
+for REPO_INDEX in $(seq 0 $(expr $REPOSITORIES_AMOUNT - 1)); do
+  echo
+  REPO_NAME=$(cat repositories.yaml | yq ".repositories[$REPO_INDEX].name" -r)
+  REPO_URL=$(cat repositories.yaml | yq ".repositories[$REPO_INDEX].url" -r)
+  REPO_DOCKER_COMPOSE_NAME=$(cat repositories.yaml | yq ".repositories[$REPO_INDEX].docker_compose_name" -r)
+  log_debug "REPO_NAME - $REPO_NAME"
+  log_debug "REPO_URL - $REPO_URL"
+  log_debug "REPO_DOCKER_COMPOSE_NAME - $REPO_DOCKER_COMPOSE_NAME"
+  log_info "Processing repository '$REPO_NAME'"
+  create_repo_version $REPO_NAME $REPO_URL
+done
+log_debug "Tags per project: ${REPO_TAGS_ARRAY[*]}"
+
+echo
+log_info "Preparing changes in deploy repo"
+create_repo_version "deploy" $DEPLOY_REPO_URL
+
+echo
+log_info "Services versions:"
+for REPO_INDEX in $(seq 0 $(expr $REPOSITORIES_AMOUNT - 1)); do
+  REPO_NAME=$(cat repositories.yaml | yq ".repositories[$REPO_INDEX].name" -r)
+  log_info "- $REPO_NAME - ${REPO_TAGS_ARRAY[$REPO_INDEX]}"
+done
+log_info "Deployment repo version - ${REPO_TAGS_ARRAY[-1]}"
+if [[ "$GIT_PUSH_CONFIRMED" != "true" ]]; then
+  log_info "To apply changes described above, set GIT_PUSH_CONFIRMED to 'true' and rerun this script"
+fi

.github/git-release-tool/repositories.yaml

@@ -12,3 +12,9 @@ repositories:
   - name: owgw-ui
     url: https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui.git
     docker_compose_name: OWGWUI_TAG
+  - name: owprov-ui
+    url: https://github.com/Telecominfraproject/wlan-cloud-owprov-ui.git
+    docker_compose_name: OWPROVUI_TAG
+  - name: owprov
+    url: https://github.com/Telecominfraproject/wlan-cloud-owprov.git
+    docker_compose_name: OWPROV_TAG

.github/workflows/enforce-jira-issue-key.yml

@@ -0,0 +1,22 @@
+name: Ensure Jira issue is linked
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+
+jobs:
+  check_for_issue_key:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout actions repo
+        uses: actions/checkout@v2
+        with:
+          repository: Telecominfraproject/.github
+          path: github
+
+      - name: Run JIRA check
+        uses: ./github/composite-actions/enforce-jira-issue-key
+        with:
+          jira_base_url: ${{ secrets.TIP_JIRA_URL }}
+          jira_user_email: ${{ secrets.TIP_JIRA_USER_EMAIL }}
+          jira_api_token: ${{ secrets.TIP_JIRA_API_TOKEN }}

.github/workflows/git-release.yml

@@ -0,0 +1,59 @@
+name: Create new release for OpenWIFI 2.x services
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_version:
+        description: 'Release version to create (i.e. v2.4.0)'
+        required: true
+      tag_type:
+        default: 'rc'
+        description: 'Tag type to create (final OR rc)'
+        required: true
+      push_confirm:
+        default: ''
+        description: 'Set to "true" if changes should be pushed (dry-run enabled by default)'
+        required: false
+      log_level:
+        default: 'INFO'
+        description: 'Log level for the script (ERROR/INFO/DEBUG)'
+        required: false
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  create_release:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repo
+      uses: actions/checkout@v2
+      with:
+        path: wlan-cloud-ucentral-deploy
+
+    - name: Install system dependencies
+      run: |
+        pip3 install yq
+        helm plugin install https://github.com/databus23/helm-diff
+        helm plugin install https://github.com/aslafy-z/helm-git
+        ls ~/.local/share/helm/plugins/helm-git/helm-git-plugin.sh || true
+        sed 's/--skip-refresh //' -i ~/.local/share/helm/plugins/helm-git/helm-git-plugin.sh
+
+    - name: Run release creation script
+      working-directory: wlan-cloud-ucentral-deploy/.github/git-release-tool
+      run: |
+        export RELEASE_VERSION=${{ github.event.inputs.release_version }}
+        export TAG_TYPE=${{ github.event.inputs.tag_type }}
+        export GIT_PUSH_CONFIRMED=${{ github.event.inputs.push_confirm }}
+        export LOG_VERBOSITY=${{ github.event.inputs.log_level }}
+        mkdir -p ~/.ssh
+        chmod -R 700 ~/.ssh
+        ssh-keyscan -H github.com >> ~/.ssh/known_hosts
+        echo https://tip-automation:${{ secrets.GIT_PUSH_PAT }}@github.com > ~/.git-credentials
+        git config --global credential.helper store
+        git config --global user.email "tip-automation@telecominfraproject.com"
+        git config --global user.name "TIP Automation User"
+        helm repo add bitnami https://charts.bitnami.com/bitnami
+        helm repo update
+        ./git-release-tool.sh

.github/workflows/release.yml

@@ -22,22 +22,22 @@ jobs:
           path: wlan-cloud-ucentral-deploy
           repository: Telecominfraproject/wlan-cloud-ucentral-deploy
 
-      - name: Run pre-checks
-        working-directory: wlan-cloud-ucentral-deploy/chart
-        run: |
-          pip3 install yq -q
-          export CHART_VERSION=$(cat Chart.yaml | yq .version -r)
-          export GIT_TAG=$(echo ${GITHUB_REF} | sed -e 's/refs\/tags\/[v]//' | tr '/' '-')
-          if [ "$CHART_VERSION" != "$GIT_TAG" ]; then
-            echo "Chart version in Chart.yaml ($CHART_VERSION) is different from Git tag ($GIT_TAG)";
-            exit 1
-          fi
-
-          #if [ "$(cat Chart.yaml | yq '.dependencies[].repository' -r | grep -E 'ref=(main|master)' | wc -l)" != "0" ]; then
-          #  echo "Some of the dependencies does not have a fixed version set. List of affected dependencies:";
-          #  cat Chart.yaml | yq '.dependencies[].repository' -r | grep -E 'ref=(main|master)';
-          #  exit 1
-          #fi
+#      - name: Run pre-checks
+#        working-directory: wlan-cloud-ucentral-deploy/chart
+#        run: |
+#          pip3 install yq -q
+#          export CHART_VERSION=$(cat Chart.yaml | yq .version -r)
+#          export GIT_TAG=$(echo ${GITHUB_REF} | sed -e 's/refs\/tags\/[v]//' | tr '/' '-')
+#          if [ "$CHART_VERSION" != "$GIT_TAG" ]; then
+#            echo "Chart version in Chart.yaml ($CHART_VERSION) is different from Git tag ($GIT_TAG)";
+#            exit 1
+#          fi
+#
+#          if [ "$(cat Chart.yaml | yq '.dependencies[].repository' -r | grep -E 'ref=(main|master)' | wc -l)" != "0" ]; then
+#            echo "Some of the dependencies does not have a fixed version set. List of affected dependencies:";
+#            cat Chart.yaml | yq '.dependencies[].repository' -r | grep -E 'ref=(main|master)';
+#            exit 1
+#          fi
 
       - name: Build package
         working-directory: wlan-cloud-ucentral-deploy/chart

chart/Chart.yaml

@@ -2,28 +2,28 @@ apiVersion: v2
 name: openwifi
 appVersion: "1.0"
 description: A Helm chart for Kubernetes
-version: 2.4.2
+version: 2.5.3
 dependencies:
 - name: owgw
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=v2.4.2"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=v2.5.3"
   version: 0.1.0
 - name: owsec
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=v2.4.2"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=v2.5.2"
   version: 0.1.0
 - name: owfms
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=v2.4.2"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=v2.5.2"
   version: 0.1.0
 - name: owprov
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov@helm?ref=v2.5.2"
   version: 0.1.0
 - name: owgwui
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=v2.4.2"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=v2.5.2"
   version: 0.1.0
 - name: owprovui
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov-ui@helm?ref=main"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov-ui@helm?ref=v2.5.2"
   version: 0.1.0
 - name: rttys
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-rtty@chart?ref=v0.1.0"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-rtty@chart?ref=main"
   version: 0.1.0
 - name: kafka
   repository: https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/

chart/README.md

@@ -7,6 +7,7 @@ This Helm chart helps to deploy OpenWIFI Cloud SDK with all required dependencie
 [helm-git](https://github.com/aslafy-z/helm-git) is required for remote the installation as it pull charts from other repositories for the deployment, so intall it if you don't have it already.
 
 ```bash
+$ helm dependency update
 $ helm install .
 ```
 
@@ -20,23 +21,35 @@ Current dependencies may be found in [chart definition](Chart.yaml) and list wil
 
 ## Installing the Chart
 
-To install the chart with the release name `my-release`:
+There are multiple ways to install this chart. Described commands will deploy the OpenWIFI Cloud SDK on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that will be overwritten above default values from dependent charts.
+
+### Installation using local git repo
+
+To install the chart from local git repo with the release name `my-release` you need to first update dependencies as it is required with dependencies deployed by helm-git:
 
 ```bash
-$ helm install --name my-release git+https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy/@chart?ref=main
+$ helm dependency update
+$ helm install .
 ```
 
-The command deploys the OpenWIFI Cloud SDK on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that will be overwritten above default values from dependent charts.
+### Installation using remote chart
 
-> **Tip**: List all releases using `helm list`
-
-If you need to update your release, it could be required to update your helm charts dependencies before installation:
+To install the chart with the release name `my-release` you need to first update dependencies as it is required with dependencies deployed by helm-git:
 
 ```bash
-helm dependency update
+$ helm install --name my-release git+https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy@chart/openwifi-0.1.0.tgz?ref=main
 ```
 
-#### Required password changing on the first startup
+### Installation using external repo
+
+This approach requires adding external helm repo and new versions are build for every [release](https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy/releases):
+
+```bash
+helm repo add tip-wlan https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/
+helm install my-release tip-wlan/openwifi
+```
+
+## Required password changing on the first startup
 
 One important action that must be done before using the deployment is changing password for the default user in owsec as described in [owsec docs](https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/tree/main#changing-default-password). Please use these docs to find the actions that must be done **after** the deployment in order to start using your deployment.
 
@@ -62,6 +75,8 @@ The following table lists the configurable parameters that overrides microservic
 | `owsec.configProperties."openwifi\.kafka\.brokerlist"` | string | Sets up Kafka broker list for OpenWIFI Security to the predictable Kubernetes service name (see `kafka.fullnameOverride` option description for details) | `'kafka:9092'` |
 | `owfms.configProperties."openwifi\.kafka\.enable"` | string | Configures OpenWIFI Firmware to use Kafka for communication | `'true'` |
 | `owfms.configProperties."openwifi\.kafka\.brokerlist"` | string | Sets up Kafka broker list for OpenWIFI Firmware to the predictable Kubernetes service name (see `kafka.fullnameOverride` option description for details) | `'kafka:9092'` |
+| `owprov.configProperties."openwifi\.kafka\.enable"` | string | Configures OpenWIFI Provisioning to use Kafka for communication | `'true'` |
+| `owprov.configProperties."openwifi\.kafka\.brokerlist"` | string | Sets up Kafka broker list for OpenWIFI Provisioning to the predictable Kubernetes service name (see `kafka.fullnameOverride` option description for details) | `'kafka:9092'` |
 | `rttys.enabled` | boolean | Enables [rttys](https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-rtty) deployment | `True` |
 | `rttys.config.token` | string | Sets default rttys token |  |
 | `kafka.enabled` | boolean | Enables [kafka](https://github.com/bitnami/charts/blob/master/bitnami/kafka/) deployment | `True` |
@@ -70,6 +85,21 @@ The following table lists the configurable parameters that overrides microservic
 | `kafka.image.repository` | string | Kafka Docker image repository | `'bitnami/kafka'` |
 | `kafka.image.tag` | string | Kafka Docker image tag | `'2.8.0-debian-10-r43'` |
 | `kafka.minBrokerId` | number | Sets Kafka minimal broker ID (useful for multi-node Kafka installations) | `100` |
+| `clustersysteminfo.enabled` | boolean | Enables post-install check that makes sure that all services are working correctly using systeminfo RESTAPI method | `false` |
+| `clustersysteminfo.delay` | integer | Number of seconds to delay clustersysteminfo execution | `0` |
+| `clustersysteminfo.public_env_variables` | hash | Map of public environment variables that will be passed to the script (required for configuration) |  |
+| `clustersysteminfo.secret_env_variables` | hash | Map of secret environment variables that will be passed to the script (for example, password) |  |
+| `clustersysteminfo.activeDeadlineSeconds` | integer | Number of seconds that are allowed for job to run before failing with Dealine Exceeded error | `2400` |
+| `clustersysteminfo.backoffLimit` | integer | Number of jobs retries before job failure | `5` |
+| `owls.enabled` | boolean | Install OpenWIFI Load Simulator in the release | `false` |
+| `owls.configProperties."openwifi\.kafka\.enable"` | string | Configures OpenWIFI Load Simulator to use Kafka for communication | `'true'` |
+| `owls.configProperties."openwifi\.kafka\.brokerlist"` | string | Sets up Kafka broker list for OpenWIFI Load Simulator to the predictable Kubernetes service name (see `kafka.fullnameOverride` option description for details) | `'kafka:9092'` |
+| `owlsui.enabled` | boolean | Install OpenWIFI Load Simulator Web UI in the release | `false` |
+| `haproxy.enabled` | boolean | Install HAproxy as a unified TCP proxy for services | `true` |
+| `haproxy.replicaCount` | Integer | Amount of HAproxy pods to start | `3` |
+| `restapiCerts.enabled` | boolean | Enable generation of self-signed certificates for REST API private endpoints (see details below) | `false` |
+| `restapiCerts.services` | array | List of services that require certificates generation |  |
+| `restapiCerts.clusterDomain` | string | Kubernetes cluster domain | `cluster.local` |
 
 If required, further overrides may be passed. They will be merged with default values from this chart and other subcharts with priority to values you'll pass.
 
@@ -90,3 +120,78 @@ $ helm install --name my-release -f values.yaml .
 ```
 
 > **Tip**: You can use the default [values.yaml](values.yaml) as a base for customization.
+
+## Optional features
+
+Some features of the SDK are not enabled by default, but you may enable them by changing your values file. Below you may find information about supported features and values that may be used as a base to enable these changes. As an example of used values you may check values files in [wlan-testing](https://github.com/Telecominfraproject/wlan-testing/tree/master/helm/ucentral) repository that are used for different automated testing pipelines.
+
+If you want to enable different features, you may try passing additional values files using `-f` flag during `helm install/upgrade` commands.
+
+### Cluster systeminfo check
+
+By setting `clusterinfo.enabled` to `true` you may enable job on post-install/post-upgrade step that will do the following:
+
+1. Change default security credentials from credentials set in OWSEC configuration file (see 'Required password changing on the first startup' block above)
+2. Check if all services started responding correctly after the deployment using systeminfo REST API method
+
+In order to do that, you need to additionaly set multiple parameters:
+
+1. clusterinfo.public_env_variables.OWSEC - OWSEC endpoint to use for CLI tools
+2. clusterinfo.secret_env_variables.OWSEC_DEFAULT_USERNAME - username used for CLI requests (see OWSEC configuration file for details)
+3. clusterinfo.secret_env_variables.OWSEC_DEFAULT_PASSWORD - default password stored in OWSEC configuration that is required for initial password change
+4. clusterinfo.secret_env_variables.OWSEC_NEW_PASSWORD - new password that should be set instead of default OWSEC password. It is set only once, then used all the time. Password must comply https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/#authenticationvalidationexpression
+
+If you are interested in script itself, see [script](https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy/blob/main/chart/docker/clustersysteminfo).
+
+You may see example values to enable this feature in [values.enable-clustersysteminfo.yaml](./feature-values/values.enable-clustersysteminfo.yaml).
+
+### Load simulation
+
+Chart also allows to install [OWLS](https://github.com/Telecominfraproject/wlan-cloud-owls) and [OWLS-UI](https://github.com/Telecominfraproject/wlan-cloud-owls-ui) alongside your installation if you are interested in load testing your installation. See services repositories for available options and configuration details.
+
+You may see example values to enable this feature in [values.enable-owls.yaml](./feature-values/values.enable-owls.yaml).
+
+### HAproxy
+
+In order to use single point of entry for all services (may be used for one cloud Load Balancer per installation) HAproxy is installed by default with other services. HAproxy is working in TCP proxy mode, so every TLS certificate is managed by services themself, while it is possible to pass requests from cloud load balancer to services using same ports (configuration of cloud load balancer may vary from cloud provider to provider).
+
+By default this option is enabled, but you may disable it and make per-service LoadBalancer using values in [values.disable-haproxy.yaml](./feature-values/values.disable-haproxy.yaml).
+
+### OWGW unsafe sysctls
+
+By default Linux is using quite adeqate sysctl values for TCP keepalive, but OWGW may keep disconnected APs in stuck state preventing it from connecting back. This may be changed by setting some sysctls to lower values:
+
+- net.ipv4.tcp_keepalive_intvl
+- net.ipv4.tcp_keepalive_probes - 2
+- net.ipv4.tcp_keepalive_time - 45
+
+However this change is [not considered safe by Kubernetes](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls) and it requires to pass additional argument to your Kubelets services in your Kubernetes cluster:
+
+```
+--allowed-unsafe-sysctls net.ipv4.tcp_keepalive_intvl,net.ipv4.tcp_keepalive_probes,net.ipv4.tcp_keepalive_time
+```
+
+After this change you may pass additional parameters to OWGW helm chart. You may see example values in [values.owgw-unsafe-sysctl.yaml](./feature-values/values.owgw-unsafe-sysctl.yaml)
+
+### Private REST API cert-manager managed certificates
+
+All services have 2 REST API endpoints - private and public one. Private endpoint is used for inter-service communication and should not be exposed to the world, but since it also requires TLS in order to work correctly, additional optional logic was implemented that allows to manage TLS certificates for such endpoints to be managed by [cert-manager](https://github.com/jetstack/cert-manager). In order to activate this feature following steps are required:
+
+0. Install and configure [cert-manager](https://cert-manager.io/docs/) in your cluster
+1. Enable option by setting `restapiCerts.enabled`
+2. If you have a different Kubernetes cluster domain, adapt `restapiCerts.clusterDomain` to your cluster domain
+3. Add additional parameters for services in order to mount certificates secrets in pods, use certificates by service and add public environment variable that will add cert-manager managed CA certificate to pod's trusted chain (see [OWGW docker-entrypoint.sh](https://github.com/Telecominfraproject/wlan-cloud-ucentralgw/blob/master/docker-entrypoint.sh) as example of how it is done)
+
+You may see example values to enable this feature in [values.restapi-certmanager-certs.yaml](./feature-values/values.restapi-certmanager-certs.yaml).
+
+## Environment specific values
+
+This repository contains values files that may be used in the same manner as feature values above to deploy to specific runtime envionemnts (including different cloud deployments).
+
+Some environments are using [external-dns](https://github.com/kubernetes-sigs/external-dns) service to dynamically set DNS records, but you may manage your records manually
+
+### AWS EKS
+
+EKS based installation assumes that you are using [AWS Load Balancer controller](https://kubernetes-sigs.github.io/aws-load-balancer-controller) so that all required ALBs and NLBs are created automatically. Also it is assumed that you have Route53 managed DNS zone and you've issued wildcard certificate for one of your zones that may be used by Load Balancers.
+
+You may see example values for this environment in [values.aws.yaml](./environment-values/values.aws.yaml).

chart/docker/clustersysteminfo

@@ -44,18 +44,7 @@ then
   exit 3
 fi
 
-# Adapt scripts for the security credentials
-# -> Username
-sed '/^username/s/username=.*/username="'$OWSEC_DEFAULT_USERNAME'"/' owsec_cli -i
-sed '/^username/s/username=.*/username="'$OWSEC_DEFAULT_USERNAME'"/' owgw_cli -i
-sed '/^username/s/username=.*/username="'$OWSEC_DEFAULT_USERNAME'"/' owfms_cli -i
-sed '/^username/s/username=.*/username="'$OWSEC_DEFAULT_USERNAME'"/' owprov_cli -i
-# -> Password
-sed '/^password/s/password=.*/password="'$OWSEC_NEW_PASSWORD'"/' owsec_cli -i
-sed '/^password/s/password=.*/password="'$OWSEC_NEW_PASSWORD'"/' owgw_cli  -i
-sed '/^password/s/password=.*/password="'$OWSEC_NEW_PASSWORD'"/' owfms_cli -i
-sed '/^password/s/password=.*/password="'$OWSEC_NEW_PASSWORD'"/' owprov_cli -i
-# -> Configuration using env variables
+# Prepare security credentials for cli usage
 export OWSEC_USERNAME=${OWSEC_DEFAULT_USERNAME}
 export OWSEC_PASSWORD=${OWSEC_NEW_PASSWORD}
 

chart/environment-values/deploy.sh

@@ -138,6 +138,14 @@ for EXTRA_VALUE in ${EXTRA_VALUES_SPLITTED[*]}; do
   EXTRA_VALUES_FLAGS+=("--set" $EXTRA_VALUE)
 done
 
+if [[ "$USE_SEPARATE_OWGW_LB" == "true" ]]; then
+  export HAPROXY_SERVICE_DNS_RECORDS="sec-${NAMESPACE}.cicd.lab.wlan.tip.build\,fms-${NAMESPACE}.cicd.lab.wlan.tip.build\,prov-${NAMESPACE}.cicd.lab.wlan.tip.build\,rtty-${NAMESPACE}.cicd.lab.wlan.tip.build"
+  export OWGW_SERVICE_DNS_RECORDS="gw-${NAMESPACE}.cicd.lab.wlan.tip.build"
+else
+  export HAPROXY_SERVICE_DNS_RECORDS="gw-${NAMESPACE}.cicd.lab.wlan.tip.build\,sec-${NAMESPACE}.cicd.lab.wlan.tip.build\,fms-${NAMESPACE}.cicd.lab.wlan.tip.build\,prov-${NAMESPACE}.cicd.lab.wlan.tip.build\,rtty-${NAMESPACE}.cicd.lab.wlan.tip.build"
+  export OWGW_SERVICE_DNS_RECORDS=""
+fi
+
 # Run the deployment
 helm upgrade --install --create-namespace --wait --timeout 60m \
   --namespace openwifi-${NAMESPACE} \
@@ -185,6 +193,8 @@ helm upgrade --install --create-namespace --wait --timeout 60m \
   --set owlsui.ingresses.default.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=lsui-${NAMESPACE}.cicd.lab.wlan.tip.build \
   --set owlsui.ingresses.default.hosts={lsui-${NAMESPACE}.cicd.lab.wlan.tip.build} \
   --set owlsui.public_env_variables.DEFAULT_UCENTRALSEC_URL=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set haproxy.service.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=$HAPROXY_SERVICE_DNS_RECORDS \
+  --set owgw.services.owgw.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=$OWGW_SERVICE_DNS_RECORDS \
   ${EXTRA_VALUES_FLAGS[*]} \
   --set-file owgw.certs."restapi-cert\.pem"=$CERT_LOCATION \
   --set-file owgw.certs."restapi-key\.pem"=$KEY_LOCATION \

chart/environment-values/values.aws.yaml

@@ -0,0 +1,91 @@
+# TODO adapt config for your environments - change FQDNs, certificates and security credentials
+owgw:
+  configProperties: # TODO change FQDNs
+    openwifi.fileuploader.host.0.name: gw.cicd.lab.wlan.tip.build
+    openwifi.system.uri.public: https://gw.cicd.lab.wlan.tip.build:16002
+    openwifi.system.uri.private: https://gw.cicd.lab.wlan.tip.build:17002
+    openwifi.system.uri.ui: https://webui.cicd.lab.wlan.tip.build
+    rtty.server: rtty.cicd.lab.wlan.tip.build
+    rtty.token: TOFILL # TODO change rttys token to the same used in rttys below
+
+owgwui:
+  ingresses:
+    default:
+      enabled: true
+      annotations:
+        kubernetes.io/ingress.class: alb
+        alb.ingress.kubernetes.io/scheme: internet-facing
+        alb.ingress.kubernetes.io/group.name: wlan-cicd
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285 # TODO change certificate
+        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
+        alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
+        external-dns.alpha.kubernetes.io/hostname: webui.cicd.lab.wlan.tip.build # TODO change FQDN
+      paths:
+      - path: /*
+        serviceName: owgwui
+        servicePort: http
+
+  public_env_variables:
+    DEFAULT_UCENTRALSEC_URL: https://sec.cicd.lab.wlan.tip.build:16001 # TODO change to OWSEC RESTAPI url
+
+owsec:
+  configProperties: # TODO change FQDNs and credentials
+    authentication.default.username: tip@ucentral.com
+    authentication.default.password: TOFILL # TODO change password to default hashed password (see OWSEC readme for details)
+    openwifi.system.uri.public: https://sec.cicd.lab.wlan.tip.build:16001
+    openwifi.system.uri.private: https://sec.cicd.lab.wlan.tip.build:17001
+    openwifi.system.uri.ui: https://webui.cicd.lab.wlan.tip.build
+
+owfms:
+  configProperties: # TODO change FQDNs and credentials
+    s3.key: TOFILL # TODO change these values to S3 credentials to get firmwares from bucket
+    s3.secret: TOFILL
+    # TODO uncomment and change these values if you are using your own S3 bucket with firmwares
+    #s3.bucketname: ucentral-ap-firmware
+    #s3.region: us-east-1
+    #s3.bucket.uri: ucentral-ap-firmware.s3.amazonaws.com
+    openwifi.system.uri.public: https://fms.cicd.lab.wlan.tip.build:16001
+    openwifi.system.uri.private: https://fms.cicd.lab.wlan.tip.build:17001
+    openwifi.system.uri.ui: https://webui.cicd.lab.wlan.tip.build
+
+owprov:
+  configProperties: # TODO change FQDNs
+    openwifi.system.uri.public: https://prov.cicd.lab.wlan.tip.build:16001
+    openwifi.system.uri.private: https://prov.cicd.lab.wlan.tip.build:17001
+    openwifi.system.uri.ui: https://webui.cicd.lab.wlan.tip.build
+
+owprovui:
+  ingresses:
+    default:
+      enabled: true
+      annotations:
+        kubernetes.io/ingress.class: alb
+        alb.ingress.kubernetes.io/scheme: internet-facing
+        alb.ingress.kubernetes.io/group.name: wlan-cicd
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285 # TODO change certificate
+        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
+        alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
+        external-dns.alpha.kubernetes.io/hostname: provui.cicd.lab.wlan.tip.build # TODO change FQDN
+      paths:
+      - path: /*
+        serviceName: owprovui
+        servicePort: http
+
+  public_env_variables:
+    DEFAULT_UCENTRALSEC_URL: https://sec.cicd.lab.wlan.tip.build:16001 # TODO change to OWSEC RESTAPI url
+
+rttys:
+  config:
+    token: TOFILL # TODO change rttys token and set it in OWGW section above
+
+haproxy:
+  service:
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "8080"
+      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285 # TODO change certificate
+      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004,16002,16003,17002,16005,17005,16001,17001,5912,5913"
+      service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
+      external-dns.alpha.kubernetes.io/hostname: "gw.cicd.lab.wlan.tip.build,sec.cicd.lab.wlan.tip.build,fms.cicd.lab.wlan.tip.build,prov.cicd.lab.wlan.tip.build,rtty.cicd.lab.wlan.tip.build"
+

chart/environment-values/values.openwifi-qa.yaml

@@ -1,15 +1,4 @@
 owgw:
-  services:
-    owgw:
-      type: LoadBalancer
-      annotations:
-        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16102"
-        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003"
-        service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
-
   # https://telecominfraproject.atlassian.net/browse/WIFI-5840
   checks:
     owgw:
@@ -114,17 +103,6 @@ owgw:
             secretName: {{ include "owgw.fullname" . }}-owgw-restapi-tls
 
 owsec:
-  services:
-    owsec:
-      type: LoadBalancer
-      annotations:
-        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16101"
-        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16001"
-        service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
-
   # https://telecominfraproject.atlassian.net/browse/WIFI-5840
   checks:
     owsec:
@@ -212,17 +190,6 @@ owsec:
             secretName: {{ include "owsec.fullname" . }}-owsec-restapi-tls
 
 rttys:
-  services:
-    rttys:
-      type: LoadBalancer
-      annotations:
-        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "5912"
-        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "5912,5913"
-        service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
-
   resources:
     requests:
       cpu: 10m
@@ -235,9 +202,6 @@ rttys:
     cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
 
 owgwui:
-  services:
-    owgwui:
-      type: NodePort
   ingresses:
     default:
       enabled: true
@@ -265,17 +229,6 @@ owgwui:
     cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
 
 owfms:
-  services:
-    owfms:
-      type: LoadBalancer
-      annotations:
-        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16104"
-        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004"
-        service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
-
   # https://telecominfraproject.atlassian.net/browse/WIFI-5840
   checks:
     owfms:
@@ -363,17 +316,6 @@ owfms:
             secretName: {{ include "owfms.fullname" . }}-owfms-restapi-tls
 
 owprov:
-  services:
-    owprov:
-      type: LoadBalancer
-      annotations:
-        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16105"
-        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16005"
-        service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
-
   checks:
     owprov:
       readiness:
@@ -460,9 +402,6 @@ owprov:
             secretName: {{ include "owprov.fullname" . }}-owprov-restapi-tls
 
 owprovui:
-  services:
-    owprovui:
-      type: NodePort
   ingresses:
     default:
       enabled: true
@@ -481,6 +420,7 @@ owprovui:
   podAnnotations:
     cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
 
+
 kafka:
   commonAnnotations:
     cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
@@ -512,5 +452,15 @@ clustersysteminfo:
   enabled: true
   delay: 60 # delaying to wait for AWS Route53 DNS propagation
 
+haproxy:
+  service:
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "8080"
+      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
+      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004,16002,16003,17002,16005,17005,16001,17001,5912,5913,16009"
+      service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
+
 restapiCerts:
   enabled: true

chart/feature-values/values.disable-haproxy.yaml

@@ -0,0 +1,27 @@
+owgw:
+  services:
+    owgw:
+      type: LoadBalancer
+
+owsec:
+  services:
+    owsec:
+      type: LoadBalancer
+
+rttys:
+  services:
+    rttys:
+      type: LoadBalancer
+
+owfms:
+  services:
+    owfms:
+      type: LoadBalancer
+
+owprov:
+  services:
+    owprov:
+      type: LoadBalancer
+
+haproxy:
+  enabled: false

chart/feature-values/values.enable-clustersysteminfo.yaml

@@ -0,0 +1,15 @@
+clustersysteminfo:
+  enabled: true
+  delay: 0 # you may change this if you need to wait for DNS propogation or other things
+
+  public_env_variables:
+    OWSEC: owsec-owsec:16001
+    # Uncomment these options if you want to run systeminfo checks inside of cluster
+    #OWGW_OVERRIDE: owgw-owgw:16002
+    #OWFMS_OVERRIDE: owfms-owfms:16004
+    #OWPROV_OVERRIDE: owprov-owprov:16005
+
+  secret_env_variables:
+    OWSEC_DEFAULT_USERNAME: tip@ucentral.com
+    OWSEC_DEFAULT_PASSWORD: openwifi
+    OWSEC_NEW_PASSWORD: TOFILL # TODO adapt password to your new password with password policy in mind

chart/feature-values/values.enable-owls.yaml

@@ -0,0 +1,9 @@
+owgw:
+  configProperties:
+    simulatorid: 53494D020202 # This value should be set to serial number of certificate that was provided to OWLS
+
+owls:
+  enabled: true
+
+owlsui:
+  enabled: true

chart/feature-values/values.owgw-unsafe-sysctl.yaml

@@ -0,0 +1,12 @@
+owgw:
+  securityContext:
+    sysctls:
+    - name: net.ipv4.tcp_keepalive_intvl
+      value: "5"
+    - name: net.ipv4.tcp_keepalive_probes
+      value: "2"
+    - name: net.ipv4.tcp_keepalive_time
+      value: "45"
+
+  podSecurityPolicy:
+    enabled: true

chart/feature-values/values.restapi-certmanager-certs.yaml

@@ -0,0 +1,183 @@
+owgw:
+  public_env_variables:
+    SELFSIGNED_CERTS: "true"
+
+  configProperties:
+    openwifi.internal.restapi.host.0.rootca: $OWGW_ROOT/certs/restapi-certs/ca.crt
+    openwifi.internal.restapi.host.0.cert: $OWGW_ROOT/certs/restapi-certs/tls.crt
+    openwifi.internal.restapi.host.0.key: $OWGW_ROOT/certs/restapi-certs/tls.key
+    openwifi.restapi.host.0.rootca: $OWGW_ROOT/certs/restapi-certs/ca.crt
+    openwifi.restapi.host.0.cert: $OWGW_ROOT/certs/restapi-certs/tls.crt
+    openwifi.restapi.host.0.key: $OWGW_ROOT/certs/restapi-certs/tls.key
+
+  volumes:
+    owgw:
+      - name: config
+        mountPath: /owgw-data/owgw.properties
+        subPath: owgw.properties
+        # Template below will be rendered in template
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owgw.fullname" . }}-config
+      - name: certs
+        mountPath: /owgw-data/certs
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owgw.fullname" . }}-certs
+      - name: certs-cas
+        mountPath: /owgw-data/certs/cas
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owgw.fullname" . }}-certs-cas
+      - name: persist
+        mountPath: /owgw-data/persist
+        volumeDefinition: |
+          persistentVolumeClaim:
+            claimName: {{ template "owgw.fullname" . }}-pvc
+
+      - name: restapi-certs
+        mountPath: /owgw-data/certs/restapi-certs
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owgw.fullname" . }}-owgw-restapi-tls
+      - name: restapi-ca
+        mountPath: /usr/local/share/ca-certificates/restapi-ca-selfsigned.pem
+        subPath: ca.crt
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owgw.fullname" . }}-owgw-restapi-tls
+
+owsec:
+  public_env_variables:
+    SELFSIGNED_CERTS: "true"
+
+  configProperties:
+    openwifi.internal.restapi.host.0.rootca: $OWSEC_ROOT/certs/restapi-certs/ca.crt
+    openwifi.internal.restapi.host.0.cert: $OWSEC_ROOT/certs/restapi-certs/tls.crt
+    openwifi.internal.restapi.host.0.key: $OWSEC_ROOT/certs/restapi-certs/tls.key
+    openwifi.restapi.host.0.rootca: $OWSEC_ROOT/certs/restapi-certs/ca.crt
+    openwifi.restapi.host.0.cert: $OWSEC_ROOT/certs/restapi-certs/tls.crt
+    openwifi.restapi.host.0.key: $OWSEC_ROOT/certs/restapi-certs/tls.key
+
+  volumes:
+    owsec:
+      - name: config
+        mountPath: /owsec-data/owsec.properties
+        subPath: owsec.properties
+        # Template below will be rendered in template
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owsec.fullname" . }}-config
+      - name: certs
+        mountPath: /owsec-data/certs
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owsec.fullname" . }}-certs
+      - name: persist
+        mountPath: /owsec-data/persist
+        volumeDefinition: |
+          persistentVolumeClaim:
+            claimName: {{ template "owsec.fullname" . }}-pvc
+
+      - name: restapi-certs
+        mountPath: /owsec-data/certs/restapi-certs
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owsec.fullname" . }}-owsec-restapi-tls
+      - name: restapi-ca
+        mountPath: /usr/local/share/ca-certificates/restapi-ca-selfsigned.pem
+        subPath: ca.crt
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owsec.fullname" . }}-owsec-restapi-tls
+
+owfms:
+  public_env_variables:
+    SELFSIGNED_CERTS: "true"
+
+  configProperties:
+    openwifi.internal.restapi.host.0.rootca: $OWFMS_ROOT/certs/restapi-certs/ca.crt
+    openwifi.internal.restapi.host.0.cert: $OWFMS_ROOT/certs/restapi-certs/tls.crt
+    openwifi.internal.restapi.host.0.key: $OWFMS_ROOT/certs/restapi-certs/tls.key
+    openwifi.restapi.host.0.rootca: $OWFMS_ROOT/certs/restapi-certs/ca.crt
+    openwifi.restapi.host.0.cert: $OWFMS_ROOT/certs/restapi-certs/tls.crt
+    openwifi.restapi.host.0.key: $OWFMS_ROOT/certs/restapi-certs/tls.key
+
+  volumes:
+    owfms:
+      - name: config
+        mountPath: /owfms-data/owfms.properties
+        subPath: owfms.properties
+        # Template below will be rendered in template
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owfms.fullname" . }}-config
+      - name: certs
+        mountPath: /owfms-data/certs
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owfms.fullname" . }}-certs
+      - name: persist
+        mountPath: /owfms-data/persist
+        volumeDefinition: |
+          persistentVolumeClaim:
+            claimName: {{ template "owfms.fullname" . }}-pvc
+
+      - name: restapi-certs
+        mountPath: /owfms-data/certs/restapi-certs
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owfms.fullname" . }}-owfms-restapi-tls
+      - name: restapi-ca
+        mountPath: /usr/local/share/ca-certificates/restapi-ca-selfsigned.pem
+        subPath: ca.crt
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owfms.fullname" . }}-owfms-restapi-tls
+
+owprov:
+  public_env_variables:
+    SELFSIGNED_CERTS: "true"
+
+  configProperties:
+    openwifi.internal.restapi.host.0.rootca: $OWPROV_ROOT/certs/restapi-certs/ca.crt
+    openwifi.internal.restapi.host.0.cert: $OWPROV_ROOT/certs/restapi-certs/tls.crt
+    openwifi.internal.restapi.host.0.key: $OWPROV_ROOT/certs/restapi-certs/tls.key
+    openwifi.restapi.host.0.rootca: $OWPROV_ROOT/certs/restapi-certs/ca.crt
+    openwifi.restapi.host.0.cert: $OWPROV_ROOT/certs/restapi-certs/tls.crt
+    openwifi.restapi.host.0.key: $OWPROV_ROOT/certs/restapi-certs/tls.key
+
+  volumes:
+    owprov:
+      - name: config
+        mountPath: /owprov-data/owprov.properties
+        subPath: owprov.properties
+        # Template below will be rendered in template
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owprov.fullname" . }}-config
+      - name: certs
+        mountPath: /owprov-data/certs
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owprov.fullname" . }}-certs
+      - name: persist
+        mountPath: /owprov-data/persist
+        volumeDefinition: |
+          persistentVolumeClaim:
+            claimName: {{ template "owprov.fullname" . }}-pvc
+
+      - name: restapi-certs
+        mountPath: /owprov-data/certs/restapi-certs
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owprov.fullname" . }}-owprov-restapi-tls
+      - name: restapi-ca
+        mountPath: /usr/local/share/ca-certificates/restapi-ca-selfsigned.pem
+        subPath: ca.crt
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owprov.fullname" . }}-owprov-restapi-tls
+
+restapiCerts:
+  enabled: true

chart/templates/job-clustersysteminfo.yaml

@@ -30,6 +30,10 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/managed-by: {{ .Release.Service }}
     spec:
+      initContainers:
+        - name: delay
+          image: "alpine:latest"
+          command: ["/bin/sleep","{{ default 0 .Values.clustersysteminfo.delay }}"]
       containers:
         - name: clustersysteminfo-check
           image: "{{ .Values.clustersysteminfo.images.clustersysteminfo.repository }}:{{ .Values.clustersysteminfo.images.clustersysteminfo.tag }}"

chart/values.yaml

@@ -66,13 +66,12 @@ kafka:
 # clustersysteminfo check
 clustersysteminfo:
   enabled: false
-
-  fullnameOverride: clustersysteminfo
+  delay: 0 # number of seconds to delay clustersysteminfo execution
 
   images:
     clustersysteminfo:
       repository: tip-tip-wlan-cloud-ucentral.jfrog.io/clustersysteminfo
-      tag: v2.4.2
+      tag: v2.5.3
       pullPolicy: Always
 #      regcred:
 #        registry: tip-tip-wlan-cloud-ucentral.jfrog.io
@@ -99,7 +98,7 @@ clustersysteminfo:
 
   public_env_variables:
     FLAGS: "-s --connect-timeout 3"
-    OWSEC: sec:16001
+    OWSEC: owsec-owsec:16001
     CHECK_RETRIES: 30
 
   secret_env_variables:
@@ -129,7 +128,7 @@ owlsui:
 
 # HAproxy (https://github.com/bitnami/charts/tree/master/bitnami/haproxy)
 haproxy:
-  enabled: false
+  enabled: true
 
   fullnameOverride: proxy
 
@@ -376,5 +375,6 @@ restapiCerts:
     - owsec-owsec
     - owfms-owfms
     - owprov-owprov
+    - owls-owls
 
   clusterDomain: cluster.local

docker-compose/.env

@@ -1,15 +1,15 @@
 # Image tags
 COMPOSE_PROJECT_NAME=openwifi
-OWGW_TAG=v2.4.2
-OWGWUI_TAG=v2.4.2
-OWSEC_TAG=v2.4.2
-OWFMS_TAG=v2.4.2
-OWPROV_TAG=main
-OWPROVUI_TAG=main
+OWGW_TAG=v2.5.3
+OWGWUI_TAG=v2.5.2
+OWSEC_TAG=v2.5.2
+OWFMS_TAG=v2.5.2
+OWPROV_TAG=v2.5.2
+OWPROVUI_TAG=v2.5.2
 RTTYS_TAG=3.5.0
 KAFKA_TAG=latest
-ZOOKEEPER_TAG=latest
-POSTGRESQL_TAG=latest
+ZOOKEEPER_TAG=3.8
+POSTGRESQL_TAG=15.0
 
 # Microservice root/config directories
 OWGW_ROOT=/owgw-data

docker-compose/.env.letsencrypt

@@ -1,14 +1,14 @@
 # Image tags
 COMPOSE_PROJECT_NAME=openwifi
-OWGW_TAG=v2.4.2
-OWGWUI_TAG=v2.4.2
-OWSEC_TAG=v2.4.2
-OWFMS_TAG=v2.4.2
-OWPROV_TAG=main
-OWPROVUI_TAG=main
+OWGW_TAG=v2.5.3
+OWGWUI_TAG=v2.5.2
+OWSEC_TAG=v2.5.2
+OWFMS_TAG=v2.5.2
+OWPROV_TAG=v2.5.2
+OWPROVUI_TAG=v2.5.2
 RTTYS_TAG=3.5.0
 KAFKA_TAG=latest
-ZOOKEEPER_TAG=latest
+ZOOKEEPER_TAG=3.8
 ACMESH_TAG=latest
 TRAEFIK_TAG=latest
 

docker-compose/.env.selfsigned

@@ -1,14 +1,14 @@
 # Image tags
 COMPOSE_PROJECT_NAME=openwifi
-OWGW_TAG=v2.4.2
-OWGWUI_TAG=v2.4.2
-OWSEC_TAG=v2.4.2
-OWFMS_TAG=v2.4.2
-OWPROV_TAG=main
-OWPROVUI_TAG=main
+OWGW_TAG=v2.5.3
+OWGWUI_TAG=v2.5.2
+OWSEC_TAG=v2.5.2
+OWFMS_TAG=v2.5.2
+OWPROV_TAG=v2.5.2
+OWPROVUI_TAG=v2.5.2
 RTTYS_TAG=3.5.0
 KAFKA_TAG=latest
-ZOOKEEPER_TAG=latest
+ZOOKEEPER_TAG=3.8
 ACMESH_TAG=latest
 TRAEFIK_TAG=latest
 

docker-compose/owgw.env

@@ -38,6 +38,9 @@ SYSTEM_URI_PRIVATE=https://owgw.wlan.local:17002
 SYSTEM_URI_PUBLIC=https://openwifi.wlan.local:16002
 SYSTEM_URI_UI=https://openwifi.wlan.local
 #SIMULATORID=
+#IPTOCOUNTRY_PROVIDER=ipinfo
+#IPTOCOUNTRY_IPINFO_TOKEN=
+#IPTOCOUNTRY_IPDATA_APIKEY=
 RTTY_ENABLED=true
 RTTY_SERVER=openwifi.wlan.local
 #RTTY_PORT=5912

docker-compose/postgresql/init-db.sh

@@ -3,15 +3,11 @@ set -e
 
 psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL
     CREATE USER $OWGW_DB_USER WITH ENCRYPTED PASSWORD '$OWGW_DB_PASSWORD';
-    CREATE DATABASE $OWGW_DB;
-    GRANT ALL PRIVILEGES ON DATABASE $OWGW_DB TO $OWGW_DB_USER;
+    CREATE DATABASE $OWGW_DB OWNER $OWGW_DB_USER;
     CREATE USER $OWSEC_DB_USER WITH ENCRYPTED PASSWORD '$OWSEC_DB_PASSWORD';
-    CREATE DATABASE $OWSEC_DB;
-    GRANT ALL PRIVILEGES ON DATABASE $OWSEC_DB TO $OWSEC_DB_USER;
+    CREATE DATABASE $OWSEC_DB OWNER $OWSEC_DB_USER;
     CREATE USER $OWFMS_DB_USER WITH ENCRYPTED PASSWORD '$OWFMS_DB_PASSWORD';
-    CREATE DATABASE $OWFMS_DB;
-    GRANT ALL PRIVILEGES ON DATABASE $OWFMS_DB TO $OWFMS_DB_USER;
+    CREATE DATABASE $OWFMS_DB OWNER $OWFMS_DB_USER;
     CREATE USER $OWPROV_DB_USER WITH ENCRYPTED PASSWORD '$OWPROV_DB_PASSWORD';
-    CREATE DATABASE $OWPROV_DB;
-    GRANT ALL PRIVILEGES ON DATABASE $OWPROV_DB TO $OWPROV_DB_USER;
+    CREATE DATABASE $OWPROV_DB OWNER $OWPROV_DB_USER;
 EOSQL