Chg: update image tag in helm values to v2.7.2

Chg: update image tag in helm values to v2.7.2-RC1
Set fixed PostgreSQL image version tag
2026-03-20 03:40:49 +00:00 · 2022-11-04 17:19:04 +00:00 · 2022-11-01 20:43:04 +00:00 · 2022-10-27 10:22:29 +02:00 · 2022-10-21 14:22:24 +02:00 · 2022-10-19 23:07:53 +00:00
64 changed files with 963 additions and 1487 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,6 @@ on:
    branches:
      - main
      - 'release/*'
-  workflow_dispatch: {}

 defaults:
  run:
@@ -29,19 +28,19 @@ jobs:
      id: get_branch_names
      if: startsWith(github.ref, 'refs/pull/')
      run: |
-        echo "pr_branch=$(echo ${GITHUB_HEAD_REF})" >> $GITHUB_OUTPUT
+        echo ::set-output name=pr_branch::$(echo ${GITHUB_HEAD_REF})

    - name: Get created deployment tag and set as output
      id: get_deployment_upgrade_tag
      if: startsWith(github.ref, 'refs/tags/v')
      run: |
-        echo "tag=$(echo ${GITHUB_REF#refs/tags/})" >> $GITHUB_OUTPUT
+        echo ::set-output name=tag::$(echo ${GITHUB_REF#refs/tags/})

    - name: Get previous deployment tag
      id: get_deployment_tag
      if: startsWith(github.ref, 'refs/tags/v')
      run: |
-        echo "tag=$(git tag | grep -v RC | tail -2 | head -1)" >> $GITHUB_OUTPUT
+        echo ::set-output name=tag::$(git tag | grep -v RC | tail -2 | head -1)

  trigger-docker-compose-testing:
    if: startsWith(github.ref, 'refs/pull/')
@@ -49,7 +48,7 @@ jobs:
    needs: envs
    steps:
    - name: Checkout actions repo
-      uses: actions/checkout@v4
+      uses: actions/checkout@v2
      with:
        repository: Telecominfraproject/.github
        path: github
@@ -72,7 +71,7 @@ jobs:
    needs: envs
    steps:
    - name: Checkout actions repo
-      uses: actions/checkout@v4
+      uses: actions/checkout@v2
      with:
        repository: Telecominfraproject/.github
        path: github
@@ -95,7 +94,7 @@ jobs:
    needs: envs
    steps:
    - name: Checkout actions repo
-      uses: actions/checkout@v4
+      uses: actions/checkout@v2
      with:
        repository: Telecominfraproject/.github
        path: github
--- a/.github/workflows/clustersysteminfo_image_ci.yml
+++ b/.github/workflows/clustersysteminfo_image_ci.yml
@@ -22,7 +22,7 @@ jobs:
      DOCKER_REGISTRY_URL: tip-tip-wlan-cloud-ucentral.jfrog.io
      DOCKER_REGISTRY_USERNAME: ucentral
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v2

    - name: Build Docker image
      working-directory: chart/docker
@@ -55,7 +55,7 @@ jobs:

    - name: Log into Docker registry
      if: startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/pull/') || github.ref == 'refs/heads/main'
-      uses: docker/login-action@v2
+      uses: docker/login-action@v1
      with:
        registry: ${{ env.DOCKER_REGISTRY_URL }}
        username: ${{ env.DOCKER_REGISTRY_USERNAME }}
--- a/.github/workflows/enforce-jira-issue-key.yml
+++ b/.github/workflows/enforce-jira-issue-key.yml
@@ -9,7 +9,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout actions repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
        with:
          repository: Telecominfraproject/.github
          path: github
--- a/.github/workflows/git-release.yml
+++ b/.github/workflows/git-release.yml
@@ -28,7 +28,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repo
-      uses: actions/checkout@v4
+      uses: actions/checkout@v2
      with:
        path: wlan-cloud-ucentral-deploy

@@ -36,7 +36,7 @@ jobs:
      run: |
        pip3 install yq
        helm plugin install https://github.com/databus23/helm-diff
-        helm plugin install https://github.com/aslafy-z/helm-git --version 0.16.0
+        helm plugin install https://github.com/aslafy-z/helm-git
        ls ~/.local/share/helm/plugins/helm-git/helm-git-plugin.sh || true
        sed 's/--skip-refresh //' -i ~/.local/share/helm/plugins/helm-git/helm-git-plugin.sh

@@ -54,6 +54,6 @@ jobs:
        git config --global credential.helper store
        git config --global user.email "tip-automation@telecominfraproject.com"
        git config --global user.name "TIP Automation User"
-        #helm repo add bitnami https://charts.bitnami.com/bitnami
-        #helm repo update
+        helm repo add bitnami https://charts.bitnami.com/bitnami
+        helm repo update
        ./git-release-tool.sh
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,13 +11,13 @@ defaults:

 jobs:
  helm-package:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
    env:
      HELM_REPO_URL: https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/
      HELM_REPO_USERNAME: ucentral
    steps:
      - name: Checkout uCentral assembly chart repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
        with:
          path: wlan-cloud-ucentral-deploy
          repository: Telecominfraproject/wlan-cloud-ucentral-deploy
@@ -42,7 +42,9 @@ jobs:
      - name: Build package
        working-directory: wlan-cloud-ucentral-deploy/chart
        run: |
-          helm plugin install https://github.com/aslafy-z/helm-git --version 0.16.0
+          helm plugin install https://github.com/aslafy-z/helm-git --version 0.10.0
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm repo update
          helm dependency update
          mkdir dist
          helm package . -d dist
@@ -68,7 +70,7 @@ jobs:
          cat Chart.yaml | yq -r '.dependencies[] | "\(.name) - \(.repository) v\(.version)"' >> release.txt

      - name: Create GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v1
        with:
          body_path: wlan-cloud-ucentral-deploy/chart/release.txt
          files: wlan-cloud-ucentral-deploy/chart/dist/*
@@ -78,7 +80,7 @@ jobs:
    needs: helm-package
    steps:
    - name: Trigger testing of release
-      uses: peter-evans/repository-dispatch@v3
+      uses: peter-evans/repository-dispatch@v1
      with:
        token: ${{ secrets.WLAN_TESTING_PAT }}
        repository: Telecominfraproject/wlan-testing
--- a/cgw/.gitignore
+++ b/cgw/.gitignore
@@ -1,3 +0,0 @@
-values/certs.device.yaml
-websocket-key.pem
-websocket-cert.pem
--- a/cgw/.sops.yaml
+++ b/cgw/.sops.yaml
@@ -1,2 +0,0 @@
-creation_rules:
- kms: 'arn:aws:kms:us-east-2:289708231103:alias/helm-secrets'
--- a/cgw/README.md
+++ b/cgw/README.md
@@ -1,47 +0,0 @@
-# CGW Charts
-
-## Pre-requisites
-
-The following binaries are needed:
- [helmfile](https://github.com/helmfile/helmfile/releases/download/v0.165.0/helmfile_0.165.0_linux_amd64.tar.gz)
- helm
- kubectl
-
-The following helm plugins are needed:
-```bash
-helm plugin install https://github.com/aslafy-z/helm-git --version 0.16.0
-helm plugin install https://github.com/databus23/helm-diff
-```
-
-## Configuration
-
-_helmfile.yaml_ contains the configuration for all the environments. External values files are used for secrets or where appropriate. Each environment needs to be created in this file before it can be deployed. The _values/certs.device.yaml_ file is generated in github workflows.
-This file should contain the device cert and key for the domain you are deploying.
-```
-certs:
-  websocket-cert.pem: 5c0lvd0RRWUpLb1pJa...
-  websocket-key.pem: V6WEFqWEhNVFk3RGda...
-```
-To generate (with the two websocket pem files available):
-```
-echo "certs:" > values/certs.device.yaml
-kubectl create secret generic certs --dry-run=client -o yaml \
-    --from-file=websocket-key.pem --from-file=websocket-cert.pem \
-    | grep websocket- >> values/certs.device.yaml
-```
-
-## Installation
-
-To install the entire stack: `helm --environment ENVNAME apply`.
-To install just cgw: `helm --environment ENVNAME -l app=cgw apply`.
-To install just cgw with a specific image tag: `helm --environment ENVNAME -l app=cgw apply --state-values-set "cgw.tag=main"`.
-
-## Removal
-
-To remove the entire stack: `helm --environment ENVNAME delete`.
-To remove just cgw: `helm --environment ENVNAME -l app=cgw delete`.
-Delete the namespace manually if it is no longer required.
-
-# Re-installation
-
-Note that the kafka, postgres and redis charts do not want to be reinstalled so will have to be removed and installed. If you wish to upgrade these then you must follow the respective Bitnami instructions on how to upgrade these charts.
--- a/cgw/helmfile.yaml
+++ b/cgw/helmfile.yaml
@@ -1,226 +0,0 @@
-environments:
-  default:
-    values:
-    - global:
-        name: devcgw
-        namespace: openwifi-devcgw
-        domain: cicd.lab.wlan.tip.build
-        certificateARN: arn:aws:acm:us-east-2:289708231103:certificate/299d7444-acc4-46c2-ae83-40d2cd5f49be
-    - kafka:
-        enabled: true
-    - redis:
-        enabled: true
-    - postgres:
-        enabled: true
-        pgUser:
-          password: postgres
-        cgwUser:
-          name: cgw
-          password: 123
-    - cgw:
-        enabled: true
-        tag: main
-  cgw01:
-    values:
-    - global:
-        name: cgw01
-        namespace: openlan-cgw01
-        domain: cicd.lab.wlan.tip.build
-        certificateARN: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
-    - kafka:
-        enabled: true
-    - redis:
-        enabled: true
-    - postgres:
-        enabled: true
-        pgUser:
-          password: openlancgw
-        cgwUser:
-          name: cgw
-          password: openlancgw
-    - cgw:
-        enabled: true
-        tag: main
-
---
-
-helmDefaults:
-  force: false
-  timeout: 300
-  createNamespace: true
-
-releases:
- name: kafka
-  version: 28.3.0
-  namespace: {{ .Environment.Values.global.namespace }}
-  condition: kafka.enabled
-  chart: oci://registry-1.docker.io/bitnamicharts/kafka
-  labels:
-    group: base
-    app: kafka
-  values:
-    - fullnameOverride: kafka
-    - volumePermissions:
-        enabled: true
-    - commonAnnotations:
-        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
-    - readinessProbe:
-        initialDelaySeconds: 45
-    - livenessProbe:
-        initialDelaySeconds: 60
-    - heapOpts: -Xmx1024m -Xms1024m
-    - kraft:
-        enabled: true
-    - zookeeper:
-        enabled: false
-    - provisioning:
-        enabled: true
-        topics:
-          - name: CnC
-            partitions: 1
-            replicationFactor: 1
-          - name: CnC_Res
-            partitions: 1
-            replicationFactor: 1
-    - controller:
-        persistence:
-          size: 80Gi
-        replicaCount: 1
-        extraConfig: |-
-          maxMessageBytes = 1048588
-          offsets.topic.replication.factor = 1
-          transaction.state.log.replication.factor = 1
-        extraEnvVars:
-          - name: ALLOW_PLAINTEXT_LISTENER
-            value: "yes"
-        resources:
-          requests:
-            cpu: 500m
-            memory: 512Mi
-          limits:
-            cpu: 750m
-            memory: 2Gi
-    - listeners:
-        client:
-          protocol: PLAINTEXT
-          containerPort: 9092
-        controller:
-          protocol: "PLAINTEXT"
-    - broker:
-        replicaCount: 0
-        persistence:
-          size: 80Gi
-        resources:
-          requests:
-            cpu: 500m
-            memory: 512Mi
-          limits:
-            cpu: 750m
-            memory: 2Gi
-
- name: postgres
-  namespace: {{ .Environment.Values.global.namespace }}
-  chart: oci://registry-1.docker.io/bitnamicharts/postgresql
-  version: 13.4.3
-  condition: postgres.enabled
-  labels:
-    group: base
-    app: postgres
-  values:
-    - fullnameOverride: pgsql
-    # workaround for: postgresql.conf file not detected. Generating it...
-    # cp: cannot create regular file '/bitnami/postgresql/conf/postgresql.conf': Permission denied
-    - volumePermissions:
-        enabled: true
-    - global:
-        postgresql:
-          auth:
-            postgresPassword: {{ .Environment.Values.postgres.pgUser.password }}
-    - auth:
-        postgresPassword: {{ .Environment.Values.postgres.pgUser.password }}
-    - primary:
-        persistence:
-          size: 40Gi
-        extendedConfiguration: |-
-          max_connections = 550
-          shared_buffers = 128MB
-          log_error_verbosity = verbose
-          tcp_keepalives_idle = 300
-          tcp_keepalives_interval = 30
-          tcp_user_timeout = 300
-        initdb:
-          scripts:
-            initusers.sql: |-
-              CREATE USER {{ .Environment.Values.postgres.cgwUser.name }};
-              ALTER USER cgw WITH ENCRYPTED PASSWORD '{{ .Environment.Values.postgres.cgwUser.password }}';
-              CREATE DATABASE cgw OWNER {{ .Environment.Values.postgres.cgwUser.name }};
-              \c cgw
-              CREATE TABLE infrastructure_groups (id INT PRIMARY KEY, reserved_size INT, actual_size INT);
-              ALTER TABLE infrastructure_groups OWNER TO {{ .Environment.Values.postgres.cgwUser.name }};
-              CREATE TABLE infras (mac MACADDR PRIMARY KEY, infra_group_id INT, FOREIGN KEY(infra_group_id) REFERENCES infrastructure_groups(id) ON DELETE CASCADE);
-              ALTER TABLE infras OWNER TO {{ .Environment.Values.postgres.cgwUser.name }};
-
- name: redis
-  namespace: {{ .Environment.Values.global.namespace }}
-  chart: oci://registry-1.docker.io/bitnamicharts/redis
-  version: 19.5.2
-  condition: redis.enabled
-  labels:
-    group: base
-    app: redis
-  values:
-    - architecture: standalone
-    - auth:
-        enabled: false
-    - master:
-        persistence:
-          size: 20Gi
-        extraEnvVars:
-          - name: ALLOW_EMPTY_PASSWORD
-            value: "yes"
-
- name: cgw
-  namespace: {{ .Environment.Values.global.namespace }}
-  chart: ../../openlan-cgw/helm
-  #chart: "git+https://github.com/Telecominfraproject/openlan-cgw@helm?ref=main"
-  version: 0.1.0
-  condition: cgw.enabled
-  labels:
-    group: apps
-    app: cgw
-  values:
-    - values/certs.tip.yaml
-    # this one is generated from GH secrets:
-    - values/certs.device.yaml
-    - images:
-        cgw:
-          tag: {{ .Environment.Values.cgw.tag }}
-    - public_env_variables:
-        CGW_DB_HOST: pgsql
-        CGW_DB_PORT: "5432"
-        CGW_DB_USERNAME: "{{ .Environment.Values.postgres.cgwUser.name }}"
-        CGW_KAFKA_HOST: kafka
-        CGW_KAFKA_PORT: "9092"
-        CGW_REDIS_HOST: redis-master
-        CGW_REDIS_PORT: "6379"
-        CGW_ALLOW_CERT_MISMATCH: "yes"
-        # use (#cpus * 2) - 2
-        DEFAULT_WSS_THREAD_NUM: "4"
-        # Useful for debugging:
-        #CGW_LOG_LEVEL: "debug"
-        #RUST_BACKTRACE: "full"
-    - secret_env_variables:
-        CGW_DB_PASSWORD: "{{ .Environment.Values.postgres.cgwUser.password }}"
-    - services:
-        cgw:
-          type: LoadBalancer
-          annotations:
-            external-dns.alpha.kubernetes.io/hostname: cgw-{{ .Environment.Values.global.name }}.{{ .Environment.Values.global.domain }}
-            #service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
-            service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-            service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-            service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {{ .Environment.Values.global.certificateARN }}
-            service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "15003"
-            service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true
-            service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002"
-            alb.ingress.kubernetes.io/healthcheck-path: /health
--- a/cgw/mkcertconfig
+++ b/cgw/mkcertconfig
@@ -1,6 +0,0 @@
-#!/bin/bash
-echo "certs:"
-for f in $* ; do
-    echo "  $f: |"
-    sed -e 's/^/    /' < "$f"
-done
--- a/cgw/secrets/certs.tip.yaml
+++ b/cgw/secrets/certs.tip.yaml
--- a/cgw/secrets/values.postgres.yaml
+++ b/cgw/secrets/values.postgres.yaml
@@ -1,21 +0,0 @@
-postgres:
-    pgUser:
-        password: ENC[AES256_GCM,data:QHV7Y5Jfes4=,iv:QTs0fu7behn1g2CLheoJROFHNYvN6OpS/vcQQC0NrMs=,tag:PeaRcoDsOrEjDN9KgHUEPA==,type:str]
-    cgwUser:
-        name: ENC[AES256_GCM,data:g6J6,iv:H4HxE5orLFXZFDDVD2tAS0PkOqNJ9j6SNu1ief7Snk0=,tag:Tuj9yjBcJzZBBZRtwAY33w==,type:str]
-        password: ENC[AES256_GCM,data:5K0f,iv:+g61dhYOOTbr8TwnwwLHgW17R+6zXpQT2PfgjvofvlI=,tag:1nSVXgkTC41d1AnDDE19Hg==,type:int]
-sops:
-    kms:
-        - arn: arn:aws:kms:us-east-2:289708231103:alias/helm-secrets
-          created_at: "2024-06-12T13:45:13Z"
-          enc: AQICAHiG/4CitJjM31GdYxTw9OLz/Zs5oK+DCq0cU2fAjtAA3AEPrxIAaT+xE4C1IFYmWvmkAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMrFaPNxf0atKVKnFsAgEQgDu8uqj035qrcelG0Dq4/Ond4H5bmpUHNRVEj0C8BFxg+a4R3loIk4NBeyuA0yqC0cQeWnA5e+/SjVtGAA==
-          aws_profile: ""
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2024-06-25T17:29:15Z"
-    mac: ENC[AES256_GCM,data:gbXt2MRhlx9zGcm9ZvXjWuwSPh/QHkNngGx0j0UQ61jZTINRh4ZgERuUj7Vpo1tg/blIFWbl768wB89RAGq3n1C4AcQpX3xvC33QyCT0i4pitQmnec9RnJL0L197mioOikPxl8z56WE1014EV+Vvbk7rf1CQkqrrEIJINoqSdfE=,iv:ThbvKhY0fsaXJz9rORnvxY64vMWyM/IOgSI+kuFFbAQ=,tag:fSF4tdyf3wc5+uIfoYLc5g==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1
--- a/cgw/values/certs.tip.yaml
+++ b/cgw/values/certs.tip.yaml
@@ -1,103 +0,0 @@
-certs:
-    root.pem: |
-        -----BEGIN CERTIFICATE-----
-        MIIDojCCAoqgAwIBAgIUPVYBpqNbcLYygF6Mx+qxSWwQyFowDQYJKoZIhvcNAQEL
-        BQAwaTELMAkGA1UEBhMCVVMxJDAiBgNVBAoTG1RlbGVjb20gSW5mcmEgUHJvamVj
-        dCwgSW5jLjEMMAoGA1UECxMDVElQMSYwJAYDVQQDEx1UZWxlY29tIEluZnJhIFBy
-        b2plY3QgUm9vdCBDQTAeFw0yMTA0MTMyMjQyNDRaFw0zMTA0MTMyMjM4NDZaMGkx
-        CzAJBgNVBAYTAlVTMSQwIgYDVQQKExtUZWxlY29tIEluZnJhIFByb2plY3QsIElu
-        Yy4xDDAKBgNVBAsTA1RJUDEmMCQGA1UEAxMdVGVsZWNvbSBJbmZyYSBQcm9qZWN0
-        IFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIGCibwf5u
-        AAwZ+1H8U0e3u2V+0d2gSctucoK86XwUmfe1V2a/qlCYZd29r80IuN1IIeB0naIm
-        KnK/MzXW87clF6tFd1+HzEvmlY/W4KyIXalVCTEzirFSvBEG2oZpM0yC3AefytAO
-        aOpA00LaM3xTfTqMKIRhJBuLy0I4ANUVG6ixVebbGuc78IodleqiLoWy2Q9QHyEO
-        t/7hZndJhiVogh0PveRhho45EbsACu7ymDY+JhlIleevqwlE3iQoq0YcmYADHno6
-        Eq8vcwLpZFxihupUafkd1T3WJYQAJf9coCjBu2qIhNgrcrGD8R9fGswwNRzMRMpX
-        720+GjcDW3bJAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFAJG
-        lmB5sVP2qfL3xZ8hQOTpkQH6MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsF
-        AAOCAQEAVjl9dm4epG9NUYnagT9sg7scVQEPfz3Lt6w1NXJXgD8mAUlK0jXmEyvM
-        dCPD4514n+8+lM7US8fh+nxc7jO//LwK17Wm9FblgjNFR7+anv0Q99T9fP19DLlF
-        PSNHL2emogy1bl1lLTAoj8nxg2wVKPDSHBGviQ5LR9fsWUIJDv9Bs5k0qWugWYSj
-        19S6qnHeskRDB8MqRLhKMG82oDVLerSnhD0P6HjySBHgTTU7/tYS/OZr1jI6MPbG
-        L+/DtiR5fDVMNdBSGU89UNTi0wHY9+RFuNlIuvZC+x/swF0V9R5mN+ywquTPtDLA
-        5IOM7ItsRmen6u3qu+JXros54e4juQ==
-        -----END CERTIFICATE-----
-    cas.pem: |
-        -----BEGIN CERTIFICATE-----
-        MIIEnDCCA4SgAwIBAgIUVpyCUx1MUeUwxg+7I1BvGFTz7HkwDQYJKoZIhvcNAQEL
-        BQAwaTELMAkGA1UEBhMCVVMxJDAiBgNVBAoTG1RlbGVjb20gSW5mcmEgUHJvamVj
-        dCwgSW5jLjEMMAoGA1UECxMDVElQMSYwJAYDVQQDEx1UZWxlY29tIEluZnJhIFBy
-        b2plY3QgUm9vdCBDQTAeFw0yMTA0MTMyMjUxMjZaFw0yNjA0MTMyMjM4NDZaMGwx
-        CzAJBgNVBAYTAlVTMSQwIgYDVQQKExtUZWxlY29tIEluZnJhIFByb2plY3QsIElu
-        Yy4xDDAKBgNVBAsTA1RJUDEpMCcGA1UEAxMgVGVsZWNvbSBJbmZyYSBQcm9qZWN0
-        IElzc3VpbmcgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtKBrq
-        qd2aKVSk25KfL5xHu8X7/8rJrz3IvyPuVKWhk/N1zabot3suBcGaYNKjnRHxg78R
-        yKwKzajKYWtiQFqztu24g16LQeAnoUxZnF6a0z3JkkRPsz14A2y8TUhdEe1tx+UU
-        4VGsk3n+FMmOQHL+79FO57zQC1LwylgfLSltrI6mF3jowVUQvnwzKhUzT87AJ6EO
-        ndK/q0T/Bgi+aI39zfVOjJjsTJwghvrmYW3iarP1THSKxeib2s02bZKrvvHa5HL4
-        UI8+LvREpVZl4mzt1z6Nl344Y6f+UeJlYa/Ci0jJqaXJmyVnUbAz+c0i5JfwAVn3
-        YQzfC4eLnZCmdF8zAgMBAAGjggE3MIIBMzAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
-        DgQWBBSzG1S44EerPfM4gOQ85f0AYW3R6DAfBgNVHSMEGDAWgBQCRpZgebFT9qny
-        98WfIUDk6ZEB+jAOBgNVHQ8BAf8EBAMCAYYwgYMGCCsGAQUFBwEBBHcwdTAoBggr
-        BgEFBQcwAYYcaHR0cDovL29jc3Aub25lLmRpZ2ljZXJ0LmNvbTBJBggrBgEFBQcw
-        AoY9aHR0cDovL2NhY2VydHMub25lLmRpZ2ljZXJ0LmNvbS9UZWxlY29tSW5mcmFQ
-        cm9qZWN0Um9vdENBLmNydDBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vY3JsLm9u
-        ZS5kaWdpY2VydC5jb20vVGVsZWNvbUluZnJhUHJvamVjdFJvb3RDQS5jcmwwDQYJ
-        KoZIhvcNAQELBQADggEBAFbz+K94bHIkBMJqps0dApniUmOn0pO6Q6cGh47UP/kX
-        IiPIsnYgG+hqYD/qtsiqJhaWi0hixRWn38UmvZxMRk27aSTGE/TWx0JTC3qDGsSe
-        XkUagumbSfmS0ZyiTwMPeGAjXwyzGorqZWeA95eKfImntMiOf3E7//GK0K7HpCx8
-        IPCnLZsZD2q/mLyBsduImFIRQJbLAhwIxpcd1qYJk+BlGFL+HtBpEbq6JxW2Xy+v
-        DpNWc2WIsUTle0rTc9JNJrLX4ChUJmKqf8obKHap3Xh3//qw/jDB9pOAinA33FLJ
-        EmCnwBvQr9mfNmPBGMYZVU8cPruDQJ57GjmmvdisbJY=
-        -----END CERTIFICATE-----
-        -----BEGIN CERTIFICATE-----
-        MIIDojCCAoqgAwIBAgIUPVYBpqNbcLYygF6Mx+qxSWwQyFowDQYJKoZIhvcNAQEL
-        BQAwaTELMAkGA1UEBhMCVVMxJDAiBgNVBAoTG1RlbGVjb20gSW5mcmEgUHJvamVj
-        dCwgSW5jLjEMMAoGA1UECxMDVElQMSYwJAYDVQQDEx1UZWxlY29tIEluZnJhIFBy
-        b2plY3QgUm9vdCBDQTAeFw0yMTA0MTMyMjQyNDRaFw0zMTA0MTMyMjM4NDZaMGkx
-        CzAJBgNVBAYTAlVTMSQwIgYDVQQKExtUZWxlY29tIEluZnJhIFByb2plY3QsIElu
-        Yy4xDDAKBgNVBAsTA1RJUDEmMCQGA1UEAxMdVGVsZWNvbSBJbmZyYSBQcm9qZWN0
-        IFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIGCibwf5u
-        AAwZ+1H8U0e3u2V+0d2gSctucoK86XwUmfe1V2a/qlCYZd29r80IuN1IIeB0naIm
-        KnK/MzXW87clF6tFd1+HzEvmlY/W4KyIXalVCTEzirFSvBEG2oZpM0yC3AefytAO
-        aOpA00LaM3xTfTqMKIRhJBuLy0I4ANUVG6ixVebbGuc78IodleqiLoWy2Q9QHyEO
-        t/7hZndJhiVogh0PveRhho45EbsACu7ymDY+JhlIleevqwlE3iQoq0YcmYADHno6
-        Eq8vcwLpZFxihupUafkd1T3WJYQAJf9coCjBu2qIhNgrcrGD8R9fGswwNRzMRMpX
-        720+GjcDW3bJAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFAJG
-        lmB5sVP2qfL3xZ8hQOTpkQH6MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsF
-        AAOCAQEAVjl9dm4epG9NUYnagT9sg7scVQEPfz3Lt6w1NXJXgD8mAUlK0jXmEyvM
-        dCPD4514n+8+lM7US8fh+nxc7jO//LwK17Wm9FblgjNFR7+anv0Q99T9fP19DLlF
-        PSNHL2emogy1bl1lLTAoj8nxg2wVKPDSHBGviQ5LR9fsWUIJDv9Bs5k0qWugWYSj
-        19S6qnHeskRDB8MqRLhKMG82oDVLerSnhD0P6HjySBHgTTU7/tYS/OZr1jI6MPbG
-        L+/DtiR5fDVMNdBSGU89UNTi0wHY9+RFuNlIuvZC+x/swF0V9R5mN+ywquTPtDLA
-        5IOM7ItsRmen6u3qu+JXros54e4juQ==
-        -----END CERTIFICATE-----
-        -----BEGIN CERTIFICATE-----
-        MIIE5DCCAsygAwIBAgIUJdCMN900+sZN4pJmZ4SVd2KRNBowDQYJKoZIhvcNAQEL
-        BQAwDTELMAkGA1UEAwwCQ0EwHhcNMjQwNjEzMTc1ODMwWhcNMjUwNjEzMTc1ODMw
-        WjANMQswCQYDVQQDDAJDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
-        ALHSZH2fO1ho8aETiRwJZw1dlzk4ny364TdfY35AfhocvCozxmoKTcT69RqMtUIM
-        dStOoHhRenKnEPKHF4SrgrebsYJeXysLVb3UMEkrV6I9sKeBbUq2neAAibv+Xq0X
-        KpgJM8ZSq3WugI7pJ9kRIrRbErm8FycIW+BhBTn5g/thBnwtBn0FJ4QpnBkl38bZ
-        vYoOp77oVSk42hijD56hJwyg9yVo4MbZRhpROkL8/rPrLXDfeM3yXKx+kvNCY01m
-        8IxGUMh/3UuU8wWXaGRIAcWapZpDrDaM8YdDdVfoIv6pqCU6zLhrDm2gyYABkM2q
-        VKNruHDvrcV6BT1ldW59RkRWWW8UqsIUYuvjHMBSgEijiCCmCcrNTdd1dg+9ycdU
-        p2ZHw4g5QwyGrosUMC34Hl7zz+Aj+gA3gBAyeX2Mg9E0WtDoX6as9fRZebP5fYwj
-        Qh4bjv3Rx+a68G8DrPE7CJAJHTmthgyjINLn8/RcPpo0MYh/r47Sy1+nWBCnibYZ
-        vKkDCsRjVd5mDwRAQE0YCEiissgNgVdV6LjW4pnkIsPlHpI15A7PiDRQEKHdmRYL
-        NaIQKrn6x7Tj+o9Bs3VEoyIR1qNEYuuRGeXgTRWT1QWGX+0oN5OMzkcEKtLzPRJR
-        wW+h5C+gyp2KB7pU3umk5pFMVPlT7hbAaCyzuhNWQL5fAgMBAAGjPDA6MAwGA1Ud
-        EwQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBTEa33fF8DibprD2kyGKfts
-        +Gk2QTANBgkqhkiG9w0BAQsFAAOCAgEAjad+ygI3Cp5wFHyjc9cjkU5+6qQM8qXM
-        g6B9QAqbsejzBC2euFfkLKGPGTxyPoX5fjNGreMFu6bYVS4MdObMPfaEgUdJeTLA
-        t/FGw22/zJDsKceZDFvIGoW2BvyXbqKUXXzonhE1/OXSKI1Me5cJo8GqA8J97VGh
-        TooDNzNXjvOeMMXzvugoFtXGXey/4tus1S1pSYglW/rB/exhBgZVrW5ElOPqLeK4
-        QEiP90jD303Rhw7aogrMVMcQWQ8ONyBEuQdno8/Ypil4uQXh4kYbbhgbrzT6Ux4Y
-        x9KIGbydYkNlqU4M/B1GPDsOfYauJmDpMvoUxPTolaPbIhrPmONudbUZVnrSEgOo
-        NAREI2hWRTnsqb76ugQayr7UQCzX4gQ99UllDLuvoAsc45s2pY3fJlQHkhl1JkGw
-        YlB1lF22Z35aWxkhXaYJHvhtZpt0oJ9vN//JJveBPOSajNsVnY6MIk4numI30BlZ
-        YSKHKYrYvD1yR/MSCeKVGWqsWRGfFk2bZGFjVgdlusFrjZM8JNbZtTVnKzTdoDiW
-        BnVJcd552gsT2yhaIvBoqoq4ufVa1gDGM4qRz0dxTW7850Qp++iWHMbwXRoJ3dow
-        /vreJoe6yYx8dQDw/Adl8SNV5Uo0ws36VUI/Vkuj3vG2oMP0P5DSRVQIzKxZ8FM1
-        0bJQwZgh3Is=
-        -----END CERTIFICATE-----
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -2,32 +2,39 @@ apiVersion: v2
 name: openwifi
 appVersion: "1.0"
 description: A Helm chart for Kubernetes
-version: 3.2.0-RC3
+version: 2.7.2
 dependencies:
 - name: owgw
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=v3.2.0-RC3"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw@helm?ref=v2.7.2"
  version: 0.1.0
 - name: owsec
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=v3.2.0-RC2"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralsec@helm?ref=v2.7.0"
  version: 0.1.0
 - name: owfms
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=v3.2.0-RC1"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralfms@helm?ref=v2.7.0"
  version: 0.1.0
 - name: owprov
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov@helm?ref=v3.2.0-RC2"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov@helm?ref=v2.7.0"
  version: 0.1.0
 - name: owanalytics
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-analytics@helm?ref=v3.2.0-RC2"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-analytics@helm?ref=v2.7.0"
  version: 0.1.0
 - name: owgwui
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=v3.1.0"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-ucentralgw-ui@helm?ref=v2.7.0"
  version: 0.1.0
 - name: owprovui
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov-ui@helm?ref=v3.1.0"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owprov-ui@helm?ref=v2.7.0"
  version: 0.1.0
 - name: owsub
-  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-userportal@helm?ref=v3.2.0-RC1"
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-userportal@helm?ref=v2.7.0"
  version: 0.1.0
+- name: owrrm
+  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-rrm@helm?ref=v2.7.0"
+  version: 0.1.0
+- name: kafka
+  repository: https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/
+  version: 13.0.2
+  condition: kafka.enabled
 - name: owls
  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owls@helm?ref=main"
  version: 0.1.0
@@ -36,15 +43,11 @@ dependencies:
  repository: "git+https://github.com/Telecominfraproject/wlan-cloud-owls-ui@helm?ref=master"
  version: 0.1.0
  condition: owlsui.enabled
- name: kafka
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 28.2.3
-  condition: kafka.enabled
 - name: haproxy
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 0.13.3
+  repository: https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/
+  version: 0.2.21
  condition: haproxy.enabled
- name: postgresql
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 13.4.3
-  condition: postgresql.enabled
+- name: postgresql-ha
+  repository: https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/
+  version: 8.6.13
+  condition: postgresql-ha.enabled
--- a/chart/README.md
+++ b/chart/README.md
@@ -1,10 +1,10 @@
 # openwifi

-This Helm chart helps to deploy OpenWIFI Cloud SDK with all required dependencies to the Kubernetes clusters. The purpose of this chart is to set up the correct connections between other microservices and other dependencies with correct Values and other charts as dependencies in [chart definition](Chart.yaml)
+This Helm chart helps to deploy OpenWIFI Cloud SDK with all required dependencies to the Kubernetes clusters. Purpose of this chart is to setup correct connections between other microservices and other dependencies with correct Values and other charts as dependencies in [chart definition](Chart.yaml)

 ## TL;DR;

-[helm-git](https://github.com/aslafy-z/helm-git) is required for remote the installation as it pull charts from other repositories for the deployment, so install it if you don't have it already.
+[helm-git](https://github.com/aslafy-z/helm-git) is required for remote the installation as it pull charts from other repositories for the deployment, so intall it if you don't have it already.

 Using that you can deploy Cloud SDK with 2 setups - without TLS certificates for RESTAPI endpoints and with them.

@@ -20,10 +20,11 @@ $ kubectl create secret generic openwifi-certs --from-file=../docker-compose/cer
 $ helm upgrade --install -f environment-values/values.base.secure.yaml openwifi .
 ```

-In order to access the UI and other RESTAPI endpoints you should run the following commands after the deployment:
+In order to acces the UI and other RESTAPI endpoints you should run the following commands after the deployment:

 ```
 $ kubectl port-forward deployment/proxy 5912 5913 16001 16002 16003 16004 16005 16006 16009 &
+$ kubectl port-forward deployment/owrrm 16789 &
 $ kubectl port-forward deployment/owgwui 8080:80 &
 $ kubectl port-forward deployment/owprovui 8088:80 &
 ```
@@ -42,10 +43,11 @@ $ kubectl create secret generic openwifi-certs --from-file=../docker-compose/cer
 $ helm upgrade --install -f environment-values/values.base.insecure.yaml openwifi .
 ```

-In order to access the UI and other RESTAPI endpoints you should run the following commands after the deployment:
+In order to acces the UI and other RESTAPI endpoints you should run the following commands after the deployment:

 ```
 $ kubectl port-forward deployment/proxy 5912 5913 16001 16002 16003 16004 16005 16006 16009 &
+$ kubectl port-forward deployment/owrrm 16789 &
 $ kubectl port-forward deployment/owgwui 8080:80 &
 $ kubectl port-forward deployment/owprovui 8088:80 &
 ```
@@ -141,6 +143,8 @@ The following table lists the configurable parameters that overrides microservic
 | `owsub.configProperties."openwifi\.kafka\.enable"` | string | Configures OpenWIFI Subscription to use Kafka for communication | `'true'` |
 | `owsub.configProperties."openwifi\.kafka\.brokerlist"` | string | Sets up Kafka broker list for OpenWIFI Subscription to the predictable Kubernetes service name (see `kafka.fullnameOverride` option description for details) | `'kafka:9092'` |
 | `owsub.certs` | map | Map with multiline string containing TLS certificates and private keys required for REST API |  |
+| `owrrm.public_env_variables` | map | Map of public environment variables passed to OpenWIFI RRM service |  |
+| `owrrm.mysql.enabled` | boolean | Flag to enable MySQL database deployment of OpenWIFI RRM service using subchart | `true` |
 | `kafka.enabled` | boolean | Enables [kafka](https://github.com/bitnami/charts/blob/master/bitnami/kafka/) deployment | `true` |
 | `kafka.fullnameOverride` | string | Overrides Kafka Kubernetes service name so it could be predictable and set in microservices configs | `'kafka'` |
 | `kafka.image.registry` | string | Kafka Docker image registry | `'docker.io'` |
@@ -163,7 +167,7 @@ The following table lists the configurable parameters that overrides microservic
 | `restapiCerts.services` | array | List of services that require certificates generation |  |
 | `restapiCerts.clusterDomain` | string | Kubernetes cluster domain | `cluster.local` |

-If required, further overrides may be passed. They will be merged with default values from this chart and other sub-charts with priority to values you'll pass.
+If required, further overrides may be passed. They will be merged with default values from this chart and other subcharts with priority to values you'll pass.

 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,

@@ -196,7 +200,7 @@ By setting `clusterinfo.enabled` to `true` you may enable job on post-install/po
 1. Change default security credentials from credentials set in OWSEC configuration file (see 'Required password changing on the first startup' block above)
 2. Check if all services started responding correctly after the deployment using systeminfo REST API method

-In order to do that, you need to additionally set multiple parameters:
+In order to do that, you need to additionaly set multiple parameters:

 1. clusterinfo.public_env_variables.OWSEC - OWSEC endpoint to use for CLI tools
 2. clusterinfo.secret_env_variables.OWSEC_DEFAULT_USERNAME - username used for CLI requests (see OWSEC configuration file for details)
@@ -217,17 +221,17 @@ You may see example values to enable this feature in [values.enable-owls.yaml](.

 In order to use single point of entry for all services (may be used for one cloud Load Balancer per installation) HAproxy is installed by default with other services. HAproxy is working in TCP proxy mode, so every TLS certificate is managed by services themself, while it is possible to pass requests from cloud load balancer to services using same ports (configuration of cloud load balancer may vary from cloud provider to provider).

-By default, this option is enabled, but you may disable it and make per-service LoadBalancer using values in [values.disable-haproxy.yaml](./feature-values/values.disable-haproxy.yaml).
+By default this option is enabled, but you may disable it and make per-service LoadBalancer using values in [values.disable-haproxy.yaml](./feature-values/values.disable-haproxy.yaml).

 ### OWGW unsafe sysctls

-By default, Linux is using quite adequate sysctl values for TCP keepalive, but OWGW may keep disconnected APs in stuck state preventing it from connecting back. This may be changed by setting some sysctls to lower values:
+By default Linux is using quite adeqate sysctl values for TCP keepalive, but OWGW may keep disconnected APs in stuck state preventing it from connecting back. This may be changed by setting some sysctls to lower values:

 - net.ipv4.tcp_keepalive_intvl
 - net.ipv4.tcp_keepalive_probes - 2
 - net.ipv4.tcp_keepalive_time - 45

-However, this change is [not considered safe by Kubernetes](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls), and it requires to pass additional argument to your Kubelets services in your Kubernetes cluster:
+However this change is [not considered safe by Kubernetes](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls) and it requires to pass additional argument to your Kubelets services in your Kubernetes cluster:

 ```
 --allowed-unsafe-sysctls net.ipv4.tcp_keepalive_intvl,net.ipv4.tcp_keepalive_probes,net.ipv4.tcp_keepalive_time
@@ -254,16 +258,16 @@ You may see example values to enable this feature in [values.restapi-disable-tls

 ### PostgreSQL storage option for services

-By default, all microservices use SQLite as default storage driver, but it is possible to use PostgreSQL for that purpose. Both [cluster-per-microservice](environment-values/values.openwifi-qa.external-db.yaml) and [cluster per installation](environment-values/values.openwifi-qa.single-external-db.yaml) deployments method may be used.
+By default all microservices except RRM service use SQLite as default storage driver, but it is possible to use PostgreSQL for that purpose. Both [cluster-per-microservice](environment-values/values.openwifi-qa.external-db.yaml) and [cluster per installation](environment-values/values.openwifi-qa.single-external-db.yaml) deployments method may be used.

 ## Environment specific values

-This repository contains values files that may be used in the same manner as feature values above to deploy to specific runtime environments (including different cloud deployments).
+This repository contains values files that may be used in the same manner as feature values above to deploy to specific runtime envionemnts (including different cloud deployments).

 Some environments are using [external-dns](https://github.com/kubernetes-sigs/external-dns) service to dynamically set DNS records, but you may manage your records manually

 ### AWS EKS

-EKS based installation assumes that you are using [AWS Load Balancer controller](https://kubernetes-sigs.github.io/aws-load-balancer-controller) so that all required ALBs and NLBs are created automatically. Also, it is assumed that you have Route53 managed DNS zone, and you've issued wildcard certificate for one of your zones that may be used by Load Balancers.
+EKS based installation assumes that you are using [AWS Load Balancer controller](https://kubernetes-sigs.github.io/aws-load-balancer-controller) so that all required ALBs and NLBs are created automatically. Also it is assumed that you have Route53 managed DNS zone and you've issued wildcard certificate for one of your zones that may be used by Load Balancers.

 You may see example values for this environment in [values.aws.yaml](./environment-values/values.aws.yaml).
--- a/chart/docker/change_credentials
+++ b/chart/docker/change_credentials
@@ -61,7 +61,7 @@ then
        echo "Logged in with new credentials:"
    fi
 else
-    echo "Credentials check failed with unexpected ErrorCode, please review the response body:"
+    echo "Credentials check failed with unexpected ErrorCode, please review the responce body:"
    jq < ${result_file}
    exit 2
 fi
--- a/chart/environment-values/.gitignore
+++ b/chart/environment-values/.gitignore
@@ -1,3 +0,0 @@
-_values.custom-*.yaml
-certs/
-env_*
--- a/chart/environment-values/cleanup.sh
+++ b/chart/environment-values/cleanup.sh
@@ -1,15 +0,0 @@
-#!/bin/bash
-[ -z "$NAMESPACE" ] && echo "No NAMESPACE set" && exit 1
-ns="openwifi-$NAMESPACE"
-echo "Cleaning up namespace $ns in 10 seconds..."
-sleep 10
-echo "- delete tip-openwifi helm release in $ns"
-helm -n "$ns" delete tip-openwifi
-if [[ "$1" == "full" ]] ; then
-    echo "- delete $ns namespace in 30 seconds..."
-    sleep 30
-    echo "- delete $ns namespace"
-    kubectl delete ns "$ns"
-fi
-echo "- cleaned up $ns namespace"
-exit 0
--- a/chart/environment-values/deploy.sh
+++ b/chart/environment-values/deploy.sh
@@ -2,77 +2,80 @@
 set -e

 # Usage function
-function usage()
-{
-    cat <<-EOF >&2
-This script is intended for OpenWIFI Cloud SDK deployment to TIP QA/Dev environments using assembly Helm chart (https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy/tree/main/chart) with configuration through environment variables
-
-Required environment variables:
- NAMESPACE - namespace suffix that will used added for the Kubernetes environment (i.e. if you pass 'test', kubernetes namespace will be named 'ucentral-test')
- DEPLOY_METHOD - deployment method for the chart deployment (supported methods - 'git' (will use helm-git from assembly chart), 'bundle' (will use chart stored in the Artifactory) or local
- CHART_VERSION - version of chart to be deployed from assembly chart (for 'git' method git ref may be passed, for 'bundle' method version of chart may be passed)
- VALUES_FILE_LOCATION - path to file with override values that may be used for deployment
- DOMAIN - Domain name. default: cicd.lab.wlan.tip.build
- OWGW_AUTH_USERNAME - username to be used for requests to OpenWIFI Security
- OWGW_AUTH_PASSWORD - hashed password for OpenWIFI Security (details on this may be found in https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/#authenticationdefaultpassword)
- OWFMS_S3_SECRET - secret key that is used for OpenWIFI Firmware access to firmwares S3 bucket
- OWFMS_S3_KEY - access key that is used for OpenWIFI Firmware access to firmwares S3 bucket
- OWSEC_NEW_PASSWORD - password that should be set to default user instead of default password from properties
- CERT_LOCATION - path to certificate in PEM format that will be used for securing all endpoint in all services
- KEY_LOCATION - path to private key in PEM format that will be used for securing all endpoint in all services
-
-The following environmnet variables may be passed, but will be ignored if CHART_VERSION is set to release (i.e. v2.4.0):
- OWGW_VERSION - OpenWIFI Gateway version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
- OWGWUI_VERSION - OpenWIFI Web UI version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
- OWSEC_VERSION - OpenWIFI Security version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
- OWFMS_VERSION - OpenWIFI Firmware version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
- OWPROV_VERSION - OpenWIFI Provisioning version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
- OWPROVUI_VERSION - OpenWIFI Provisioning Web UI version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
- OWANALYTICS_VERSION - OpenWIFI Analytics version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
- OWSUB_VERSION - OpenWIFI Subscription (Userportal) version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)
-
-Optional environment variables:
- EXTRA_VALUES - extra values that should be passed to Helm deployment separated by comma (,)
- DEVICE_CERT_LOCATION - path to certificate in PEM format that will be used for load simulator
- DEVICE_KEY_LOCATION - path to private key in PEM format that will be used for load simulator
- USE_SEPARATE_OWGW_LB - flag that should change split external DNS for OWGW and other services
- INTERNAL_RESTAPI_ENDPOINT_SCHEMA - what schema to use for internal RESTAPI endpoints (https by default)
- IPTOCOUNTRY_IPINFO_TOKEN - token that should be set for IPInfo support (owgw/owprov iptocountry.ipinfo.token properties), ommited if not passed
- MAILER_USERNAME - SMTP username used for OWSEC mailer
- MAILER_PASSWORD - SMTP password used for OWSEC mailer (only if both MAILER_PASSWORD and MAILER_USERNAME are set, mailer will be enabled)
- CERTIFICATE_ARN - Certificate ARN (will default to ap-south-1 certificate ARN)
-EOF
+usage () {
+  echo >&2;
+  echo "This script is indended for OpenWIFI Cloud SDK deployment to TIP QA/Dev environments using assembly Helm chart (https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy/tree/main/chart) with configuration through environment variables" >&2;
+  echo >&2;
+  echo "Required environment variables:" >&2;
+  echo >&2;
+  echo "- NAMESPACE - namespace suffix that will used added for the Kubernetes environment (i.e. if you pass 'test', kubernetes namespace will be named 'ucentral-test')" >&2;
+  echo "- DEPLOY_METHOD - deployment method for the chart deployment (supported methods - 'git' (will use helm-git from assembly chart) and 'bundle' (will use chart stored in the Artifactory0" >&2;
+  echo "- CHART_VERSION - version of chart to be deployed from assembly chart (for 'git' method git ref may be passed, for 'bundle' method version of chart may be passed)" >&2;
+  echo >&2;
+  echo "- VALUES_FILE_LOCATION - path to file with override values that may be used for deployment" >&2;
+  echo "- OWGW_AUTH_USERNAME - username to be used for requests to OpenWIFI Security" >&2;
+  echo "- OWGW_AUTH_PASSWORD - hashed password for OpenWIFI Security (details on this may be found in https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/#authenticationdefaultpassword)" >&2;
+  echo "- OWFMS_S3_SECRET - secret key that is used for OpenWIFI Firmware access to firmwares S3 bucket" >&2;
+  echo "- OWFMS_S3_KEY - access key that is used for OpenWIFI Firmware access to firmwares S3 bucket" >&2;
+  echo "- OWSEC_NEW_PASSWORD - password that should be set to default user instead of default password from properties" >&2;
+  echo "- CERT_LOCATION - path to certificate in PEM format that will be used for securing all endpoint in all services" >&2;
+  echo "- KEY_LOCATION - path to private key in PEM format that will be used for securing all endpoint in all services" >&2;
+  echo >&2;
+  echo "Following environmnet variables may be passed, but will be ignored if CHART_VERSION is set to release (i.e. v2.4.0):" >&2;
+  echo >&2;
+  echo "- OWGW_VERSION - OpenWIFI Gateway version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)" >&2;
+  echo "- OWGWUI_VERSION - OpenWIFI Web UI version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)" >&2;
+  echo "- OWSEC_VERSION - OpenWIFI Security version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)" >&2;
+  echo "- OWFMS_VERSION - OpenWIFI Firmware version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)" >&2;
+  echo "- OWPROV_VERSION - OpenWIFI Provisioning version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)" >&2;
+  echo "- OWPROVUI_VERSION - OpenWIFI Provisioning Web UI version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)" >&2;
+  echo "- OWANALYTICS_VERSION - OpenWIFI Analytics version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)" >&2;
+  echo "- OWSUB_VERSION - OpenWIFI Subscription (Userportal) version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)" >&2;
+  echo "- OWRRM_VERSION - OpenWIFI radio resource management service (RRM) version to deploy (will be used for Docker image tag and git branch for Helm chart if git deployment is required)" >&2;
+  echo >&2;
+  echo "Optional environment variables:" >&2;
+  echo >&2;
+  echo "- EXTRA_VALUES - extra values that should be passed to Helm deployment separated by comma (,)" >&2;
+  echo "- DEVICE_CERT_LOCATION - path to certificate in PEM format that will be used for load simulator" >&2;
+  echo "- DEVICE_KEY_LOCATION - path to private key in PEM format that will be used for load simulator" >&2;
+  echo "- USE_SEPARATE_OWGW_LB - flag that should change split external DNS for OWGW and other services" >&2;
+  echo "- INTERNAL_RESTAPI_ENDPOINT_SCHEMA - what schema to use for internal RESTAPI endpoints (https by default)" >&2;
+  echo "- IPTOCOUNTRY_IPINFO_TOKEN - token that should be set for IPInfo support (owgw/owprov iptocountry.ipinfo.token properties), ommited if not passed" >&2;
+  echo "- MAILER_USERNAME - SMTP username used for OWSEC mailer" >&2;
+  echo "- MAILER_PASSWORD - SMTP password used for OWSEC mailer (only if both MAILER_PASSWORD and MAILER_USERNAME are set, mailer will be enabled)" >&2;
 }

 # Global variables
 VALUES_FILE_LOCATION_SPLITTED=()
 EXTRA_VALUES_SPLITTED=()
-DEF_CERT_ARN="arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c"

 # Helper functions
-function check_if_chart_version_is_release()
-{
-    [[ "$CHART_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+ ]]
+check_if_chart_version_is_release() {
+  PARSED_CHART_VERSION=$(echo $CHART_VERSION | grep -xP "v\d+\.\d+\.\d+.*")
+  if [[ -z "$PARSED_CHART_VERSION" ]]; then
+    return 1
+  else
+    return 0
+  fi
 }

 # Check if required environment variables were passed
 ## Deployment specifics
 [ -z ${DEPLOY_METHOD+x} ] && echo "DEPLOY_METHOD is unset" >&2 && usage && exit 1
 [ -z ${CHART_VERSION+x} ] && echo "CHART_VERSION is unset" >&2 && usage && exit 1
-if [[ "$DEPLOY_METHOD" != "local" ]] ; then
-    if check_if_chart_version_is_release ; then
-        echo "Chart version ($CHART_VERSION) is a release version, ignoring services versions"
-    else
-        echo "Chart version ($CHART_VERSION) is not a release version, checking if services versions are set"
-        [ -z ${OWGW_VERSION+x} ] && echo "OWGW_VERSION is unset" >&2 && usage && exit 1
-        [ -z ${OWGWUI_VERSION+x} ] && echo "OWGWUI_VERSION is unset" >&2 && usage && exit 1
-        [ -z ${OWSEC_VERSION+x} ] && echo "OWSEC_VERSION is unset" >&2 && usage && exit 1
-        [ -z ${OWFMS_VERSION+x} ] && echo "OWFMS_VERSION is unset" >&2 && usage && exit 1
-        [ -z ${OWPROV_VERSION+x} ] && echo "OWPROV_VERSION is unset" >&2 && usage && exit 1
-        [ -z ${OWPROVUI_VERSION+x} ] && echo "OWPROVUI_VERSION is unset" >&2 && usage && exit 1
-        [ -z ${OWANALYTICS_VERSION+x} ] && echo "OWANALYTICS_VERSION is unset" >&2 && usage && exit 1
-        [ -z ${OWSUB_VERSION+x} ] && echo "OWSUB_VERSION is unset" >&2 && usage && exit 1
-    fi
+if check_if_chart_version_is_release; then
+  echo "Chart version ($CHART_VERSION) is release version, ignoring services versions"
+else
+  echo "Chart version ($CHART_VERSION) is not release version, checking if services versions are set"
+  [ -z ${OWGW_VERSION+x} ] && echo "OWGW_VERSION is unset" >&2 && usage && exit 1
+  [ -z ${OWGWUI_VERSION+x} ] && echo "OWGWUI_VERSION is unset" >&2 && usage && exit 1
+  [ -z ${OWSEC_VERSION+x} ] && echo "OWSEC_VERSION is unset" >&2 && usage && exit 1
+  [ -z ${OWFMS_VERSION+x} ] && echo "OWFMS_VERSION is unset" >&2 && usage && exit 1
+  [ -z ${OWPROV_VERSION+x} ] && echo "OWPROV_VERSION is unset" >&2 && usage && exit 1
+  [ -z ${OWPROVUI_VERSION+x} ] && echo "OWPROVUI_VERSION is unset" >&2 && usage && exit 1
+  [ -z ${OWANALYTICS_VERSION+x} ] && echo "OWANALYTICS_VERSION is unset" >&2 && usage && exit 1
+  [ -z ${OWSUB_VERSION+x} ] && echo "OWSUB_VERSION is unset" >&2 && usage && exit 1
+  [ -z ${OWRRM_VERSION+x} ] && echo "OWRRM_VERSION is unset" >&2 && usage && exit 1
 fi
 ## Environment specifics
 [ -z ${NAMESPACE+x} ] && echo "NAMESPACE is unset" >&2 && usage && exit 1
@@ -89,11 +92,8 @@ fi
 [ -z ${DEVICE_CERT_LOCATION+x} ] && echo "DEVICE_CERT_LOCATION is unset, setting it to CERT_LOCATION" && export DEVICE_CERT_LOCATION=$CERT_LOCATION
 [ -z ${DEVICE_KEY_LOCATION+x} ] && echo "DEVICE_KEY_LOCATION is unset, setting it to KEY_LOCATION" && export DEVICE_KEY_LOCATION=$KEY_LOCATION
 [ -z ${INTERNAL_RESTAPI_ENDPOINT_SCHEMA+x} ] && echo "INTERNAL_RESTAPI_ENDPOINT_SCHEMA is unset, setting it to 'https'" && export INTERNAL_RESTAPI_ENDPOINT_SCHEMA=https
-[ -z ${USE_SEPARATE_OWGW_LB+x} ] && echo "USE_SEPARATE_OWGW_LB is unset, setting it to false" && export USE_SEPARATE_OWGW_LB=false
 export MAILER_ENABLED="false"
 [ ! -z ${MAILER_USERNAME+x} ] && [ ! -z ${MAILER_PASSWORD+x} ] && echo "MAILER_USERNAME and MAILER_PASSWORD are set, mailer will be enabled" && export MAILER_ENABLED="true"
-[ -z "${DOMAIN}" ] && echo "DOMAIN is unset, using cicd.lab.wlan.tip.build" && export DOMAIN="cicd.lab.wlan.tip.build"
-[ -z ${CERTIFICATE_ARN+x} ] && export CERTIFICATE_ARN=$DEF_CERT_ARN

 # Transform some environment variables
 export OWGW_VERSION_TAG=$(echo ${OWGW_VERSION} | tr '/' '-')
@@ -104,69 +104,131 @@ export OWPROV_VERSION_TAG=$(echo ${OWPROV_VERSION} | tr '/' '-')
 export OWPROVUI_VERSION_TAG=$(echo ${OWPROVUI_VERSION} | tr '/' '-')
 export OWANALYTICS_VERSION_TAG=$(echo ${OWANALYTICS_VERSION} | tr '/' '-')
 export OWSUB_VERSION_TAG=$(echo ${OWSUB_VERSION} | tr '/' '-')
+export OWRRM_VERSION_TAG=$(echo ${OWRRM_VERSION} | tr '/' '-')
+
+# Debug get bash version
+bash --version >&2

 # Check deployment method that's required for this environment
 helm plugin install https://github.com/databus23/helm-diff || true
-if [[ "$DEPLOY_METHOD" == "git" ]] ; then
-    helm plugin list | grep "^helm-git" || helm plugin install https://github.com/aslafy-z/helm-git || true
-    rm -rf wlan-cloud-ucentral-deploy || true
-    git clone https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy.git
-    cd wlan-cloud-ucentral-deploy
-    git checkout $CHART_VERSION
-    cd chart
-    if ! check_if_chart_version_is_release ; then
-        sed -i '/wlan-cloud-ucentralgw@/s/ref=.*/ref='${OWGW_VERSION}'\"/g' Chart.yaml
-        sed -i '/wlan-cloud-ucentralgw-ui@/s/ref=.*/ref='${OWGWUI_VERSION}'\"/g' Chart.yaml
-        sed -i '/wlan-cloud-ucentralsec@/s/ref=.*/ref='${OWSEC_VERSION}'\"/g' Chart.yaml
-        sed -i '/wlan-cloud-ucentralfms@/s/ref=.*/ref='${OWFMS_VERSION}'\"/g' Chart.yaml
-        sed -i '/wlan-cloud-owprov@/s/ref=.*/ref='${OWPROV_VERSION}'\"/g' Chart.yaml
-        sed -i '/wlan-cloud-owprov-ui@/s/ref=.*/ref='${OWPROVUI_VERSION}'\"/g' Chart.yaml
-        sed -i '/wlan-cloud-analytics@/s/ref=.*/ref='${OWANALYTICS_VERSION}'\"/g' Chart.yaml
-        sed -i '/wlan-cloud-userportal@/s/ref=.*/ref='${OWSUB_VERSION}'\"/g' Chart.yaml
-    fi
-    #helm repo add bitnami https://charts.bitnami.com/bitnami && helm repo update
-    [ -z "$SKIP_DEPS" ] && helm dependency update
-    cd ../..
-    export DEPLOY_SOURCE="wlan-cloud-ucentral-deploy/chart"
-elif [[ "$DEPLOY_METHOD" == "bundle" ]] ; then
+if [[ "$DEPLOY_METHOD" == "git" ]]; then
+  helm plugin install https://github.com/aslafy-z/helm-git --version 0.10.0 || true
+  rm -rf wlan-cloud-ucentral-deploy || true
+  git clone https://github.com/Telecominfraproject/wlan-cloud-ucentral-deploy.git
+  cd wlan-cloud-ucentral-deploy
+  git checkout $CHART_VERSION
+  cd chart
+  if ! check_if_chart_version_is_release; then
+    sed -i '/wlan-cloud-ucentralgw@/s/ref=.*/ref='${OWGW_VERSION}'\"/g' Chart.yaml
+    sed -i '/wlan-cloud-ucentralgw-ui@/s/ref=.*/ref='${OWGWUI_VERSION}'\"/g' Chart.yaml
+    sed -i '/wlan-cloud-ucentralsec@/s/ref=.*/ref='${OWSEC_VERSION}'\"/g' Chart.yaml
+    sed -i '/wlan-cloud-ucentralfms@/s/ref=.*/ref='${OWFMS_VERSION}'\"/g' Chart.yaml
+    sed -i '/wlan-cloud-owprov@/s/ref=.*/ref='${OWPROV_VERSION}'\"/g' Chart.yaml
+    sed -i '/wlan-cloud-owprov-ui@/s/ref=.*/ref='${OWPROVUI_VERSION}'\"/g' Chart.yaml
+    sed -i '/wlan-cloud-analytics@/s/ref=.*/ref='${OWANALYTICS_VERSION}'\"/g' Chart.yaml
+    sed -i '/wlan-cloud-userportal@/s/ref=.*/ref='${OWSUB_VERSION}'\"/g' Chart.yaml
+    sed -i '/wlan-cloud-rrm@/s/ref=.*/ref='${OWRRM_VERSION}'\"/g' Chart.yaml
+  fi
+  helm repo add bitnami https://charts.bitnami.com/bitnami
+  helm repo update
+  helm dependency update
+  cd ../..
+  export DEPLOY_SOURCE="wlan-cloud-ucentral-deploy/chart"
+else
+  if [[ "$DEPLOY_METHOD" == "bundle" ]]; then
    helm repo add tip-wlan-cloud-ucentral-helm https://tip.jfrog.io/artifactory/tip-wlan-cloud-ucentral-helm/ || true
    export DEPLOY_SOURCE="tip-wlan-cloud-ucentral-helm/openwifi --version $CHART_VERSION"
-elif [[ "$DEPLOY_METHOD" == "local" ]] ; then
-    export DEPLOY_SOURCE=".."
-    pushd ..
-    [ -z "$SKIP_DEPS" ] && helm dependency update
-    popd
-else
-    echo "Deploy method is not correct: $DEPLOY_METHOD. Valid values: git, bundle or local" >&2
+  else
+    echo "Deploy method is not correct: $DEPLOY_METHOD. Valid value - git or bundle" >&2
    exit 1
+  fi
 fi

 VALUES_FILES_FLAGS=()
 IFS=',' read -ra VALUES_FILE_LOCATION_SPLITTED <<< "$VALUES_FILE_LOCATION"
 for VALUE_FILE in ${VALUES_FILE_LOCATION_SPLITTED[*]}; do
-    VALUES_FILES_FLAGS+=("-f" $VALUE_FILE)
+  VALUES_FILES_FLAGS+=("-f" $VALUE_FILE)
 done
 EXTRA_VALUES_FLAGS=()
 IFS=',' read -ra EXTRA_VALUES_SPLITTED <<< "$EXTRA_VALUES"
 for EXTRA_VALUE in ${EXTRA_VALUES_SPLITTED[*]}; do
-    EXTRA_VALUES_FLAGS+=("--set" $EXTRA_VALUE)
+  EXTRA_VALUES_FLAGS+=("--set" $EXTRA_VALUE)
 done

-if [[ "$USE_SEPARATE_OWGW_LB" == "true" ]] ; then
-  export HAPROXY_SERVICE_DNS_RECORDS="sec-${NAMESPACE}.${DOMAIN},fms-${NAMESPACE}.${DOMAIN},prov-${NAMESPACE}.${DOMAIN},analytics-${NAMESPACE}.${DOMAIN},sub-${NAMESPACE}.${DOMAIN}"
-  export OWGW_SERVICE_DNS_RECORDS="gw-${NAMESPACE}.${DOMAIN}"
+if [[ "$USE_SEPARATE_OWGW_LB" == "true" ]]; then
+  export HAPROXY_SERVICE_DNS_RECORDS="sec-${NAMESPACE}.cicd.lab.wlan.tip.build\,fms-${NAMESPACE}.cicd.lab.wlan.tip.build\,prov-${NAMESPACE}.cicd.lab.wlan.tip.build\,analytics-${NAMESPACE}.cicd.lab.wlan.tip.build\,sub-${NAMESPACE}.cicd.lab.wlan.tip.build"
+  export OWGW_SERVICE_DNS_RECORDS="gw-${NAMESPACE}.cicd.lab.wlan.tip.build"
 else
-  export HAPROXY_SERVICE_DNS_RECORDS="gw-${NAMESPACE}.${DOMAIN},sec-${NAMESPACE}.${DOMAIN},fms-${NAMESPACE}.${DOMAIN},prov-${NAMESPACE}.${DOMAIN},analytics-${NAMESPACE}.${DOMAIN},sub-${NAMESPACE}.${DOMAIN}"
+  export HAPROXY_SERVICE_DNS_RECORDS="gw-${NAMESPACE}.cicd.lab.wlan.tip.build\,sec-${NAMESPACE}.cicd.lab.wlan.tip.build\,fms-${NAMESPACE}.cicd.lab.wlan.tip.build\,prov-${NAMESPACE}.cicd.lab.wlan.tip.build\,analytics-${NAMESPACE}.cicd.lab.wlan.tip.build\,sub-${NAMESPACE}.cicd.lab.wlan.tip.build"
  export OWGW_SERVICE_DNS_RECORDS=""
 fi

-envsubst < values.custom.tpl.yaml > _values.custom-${NAMESPACE}.yaml
-
+# Run the deployment
 helm upgrade --install --create-namespace --wait --timeout 60m \
  --namespace openwifi-${NAMESPACE} \
  ${VALUES_FILES_FLAGS[*]} \
+  --set owgw.services.owgw.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=gw-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owgw.configProperties."openwifi\.fileuploader\.host\.0\.name"=gw-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owgw.configProperties."rtty\.server"=gw-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owgw.configProperties."openwifi\.system\.uri\.public"=https://gw-${NAMESPACE}.cicd.lab.wlan.tip.build:16002 \
+  --set owgw.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owgw-owgw:17002 \
+  --set owgw.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owgw.configProperties."iptocountry\.ipinfo\.token"="${IPTOCOUNTRY_IPINFO_TOKEN}" \
+  --set owgw.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set owsec.configProperties."authentication\.default\.username"=${OWGW_AUTH_USERNAME} \
+  --set owsec.configProperties."authentication\.default\.password"=${OWGW_AUTH_PASSWORD} \
+  --set owsec.services.owsec.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=sec-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owsec.configProperties."openwifi\.system\.uri\.public"=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set owsec.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsec-owsec:17001 \
+  --set owsec.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owsec.configProperties."mailer\.sender"=sec-${NAMESPACE}@cicd.lab.wlan.tip.build \
+  --set owsec.configProperties."mailer\.enabled"=$MAILER_ENABLED \
+  --set owsec.configProperties."mailer\.username"=$MAILER_USERNAME \
+  --set owsec.configProperties."mailer\.password"=$MAILER_PASSWORD \
+  --set owfms.configProperties."s3\.secret"=${OWFMS_S3_SECRET} \
+  --set owfms.configProperties."s3\.key"=${OWFMS_S3_KEY} \
+  --set owfms.services.owfms.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=fms-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owfms.configProperties."openwifi\.system\.uri\.public"=https://fms-${NAMESPACE}.cicd.lab.wlan.tip.build:16004 \
+  --set owfms.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owfms-owfms:17004 \
+  --set owfms.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owfms.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set owgwui.ingresses.default.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owgwui.ingresses.default.hosts={webui-${NAMESPACE}.cicd.lab.wlan.tip.build} \
+  --set owgwui.public_env_variables.DEFAULT_UCENTRALSEC_URL=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set owprov.services.owprov.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=prov-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owprov.configProperties."openwifi\.system\.uri\.public"=https://prov-${NAMESPACE}.cicd.lab.wlan.tip.build:16005 \
+  --set owprov.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owprov-owprov:17005 \
+  --set owprov.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owprov.configProperties."iptocountry\.ipinfo\.token"="${IPTOCOUNTRY_IPINFO_TOKEN}" \
+  --set owprov.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set owprovui.ingresses.default.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=provui-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owprovui.ingresses.default.hosts={provui-${NAMESPACE}.cicd.lab.wlan.tip.build} \
+  --set owprovui.public_env_variables.DEFAULT_UCENTRALSEC_URL=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set owprovui.public_env_variables.REACT_APP_UCENTRALSEC_URL=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set owanalytics.services.owanalytics.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=analytics-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owanalytics.configProperties."openwifi\.system\.uri\.public"=https://analytics-${NAMESPACE}.cicd.lab.wlan.tip.build:16009 \
+  --set owanalytics.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owanalytics-owanalytics:17009 \
+  --set owanalytics.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owanalytics.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set owsub.services.owsub.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=sub-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owsub.configProperties."openwifi\.system\.uri\.public"=https://sub-${NAMESPACE}.cicd.lab.wlan.tip.build:16006 \
+  --set owsub.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsub-owsub:17006 \
+  --set owsub.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owsub.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set clustersysteminfo.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set clustersysteminfo.secret_env_variables.OWSEC_NEW_PASSWORD=${OWSEC_NEW_PASSWORD} \
+  --set owls.services.owls.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=ls-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owls.configProperties."openwifi\.system\.uri\.public"=https://ls-${NAMESPACE}.cicd.lab.wlan.tip.build:16007 \
+  --set owls.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owls-owls:17007 \
+  --set owls.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owlsui.ingresses.default.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=lsui-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set owlsui.ingresses.default.hosts={lsui-${NAMESPACE}.cicd.lab.wlan.tip.build} \
+  --set owlsui.public_env_variables.DEFAULT_UCENTRALSEC_URL=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
+  --set owrrm.public_env_variables.SERVICECONFIG_PUBLICENDPOINT=https://rrm-${NAMESPACE}.cicd.lab.wlan.tip.build:16789 \
+  --set owrrm.services.owrrm.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=rrm-${NAMESPACE}.cicd.lab.wlan.tip.build \
+  --set haproxy.service.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=$HAPROXY_SERVICE_DNS_RECORDS \
+  --set owgw.services.owgw.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=$OWGW_SERVICE_DNS_RECORDS \
  ${EXTRA_VALUES_FLAGS[*]} \
-  -f _values.custom-${NAMESPACE}.yaml \
  --set-file owgw.certs."restapi-cert\.pem"=$CERT_LOCATION \
  --set-file owgw.certs."restapi-key\.pem"=$KEY_LOCATION \
  --set-file owgw.certs."websocket-cert\.pem"=$CERT_LOCATION \
--- a/chart/environment-values/values.aws.yaml
+++ b/chart/environment-values/values.aws.yaml
@@ -15,11 +15,11 @@ owgwui:
  ingresses:
    default:
      enabled: true
-      className: alb
      annotations:
+        kubernetes.io/ingress.class: alb
        alb.ingress.kubernetes.io/scheme: internet-facing
        alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285 # TODO change certificate
        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
        alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
        external-dns.alpha.kubernetes.io/hostname: webui.cicd.lab.wlan.tip.build # TODO change FQDN
@@ -29,7 +29,7 @@ owgwui:
        servicePort: http

  public_env_variables:
-    REACT_APP_UCENTRALSEC_URL: https://sec.cicd.lab.wlan.tip.build:16001 # TODO change to OWSEC RESTAPI url
+    DEFAULT_UCENTRALSEC_URL: https://sec.cicd.lab.wlan.tip.build:16001 # TODO change to OWSEC RESTAPI url

 owsec:
  configProperties: # TODO change FQDNs and credentials
@@ -65,11 +65,11 @@ owprovui:
  ingresses:
    default:
      enabled: true
-      className: alb
      annotations:
+        kubernetes.io/ingress.class: alb
        alb.ingress.kubernetes.io/scheme: internet-facing
        alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285 # TODO change certificate
        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
        alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
        external-dns.alpha.kubernetes.io/hostname: provui.cicd.lab.wlan.tip.build # TODO change FQDN
@@ -99,7 +99,8 @@ haproxy:
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
      service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "8080"
      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285 # TODO change certificate
      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004,16002,16003,17002,16005,17005,16001,17001,5912,5913,16009,16007"
      service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
-      external-dns.alpha.kubernetes.io/hostname: "gw.cicd.lab.wlan.tip.build,sec.cicd.lab.wlan.tip.build,fms.cicd.lab.wlan.tip.build,prov.cicd.lab.wlan.tip.build,rtty.cicd.lab.wlan.tip.build,sub.cicd.lab.wlan.tip.build,analytics.cicd.lab.wlan.tip.build" # TODO change FQDNs
+      external-dns.alpha.kubernetes.io/hostname: "gw.cicd.lab.wlan.tip.build,sec.cicd.lab.wlan.tip.build,fms.cicd.lab.wlan.tip.build,prov.cicd.lab.wlan.tip.build,rtty.cicd.lab.wlan.tip.build,sub.cicd.lab.wlan.tip.build,analytics.cicd.lab.wlan.tip.build,rrm.cicd.lab.wlan.tip.build" # TODO change FQDNs

--- a/chart/environment-values/values.base.insecure.yaml
+++ b/chart/environment-values/values.base.insecure.yaml
@@ -52,44 +52,36 @@ owsub:
    openwifi.system.uri.private: http://owsub-owsub:17006
    openwifi.system.uri.ui: http://localhost

+owrrm:
+  public_env_variables:
+    SELFSIGNED_CERTS: "true"
+    KAFKACONFIG_BOOTSTRAPSERVER: kafka:9092
+    DATABASECONFIG_SERVER: owrrm-mysql:3306
+    DATABASECONFIG_DBNAME: owrrm
+    DATABASECONFIG_DATARETENTIONINTERVALDAYS: "1"
+
+  secret_env_variables:
+    DATABASECONFIG_USER: root
+    DATABASECONFIG_PASSWORD: openwifi
+
+  mysql:
+    enabled: true
+    fullnameOverride: "owrrm-mysql"
+
 owgwui:
  public_env_variables:
-    REACT_APP_UCENTRALSEC_URL: http://localhost:16001
+    DEFAULT_UCENTRALSEC_URL: http://localhost:16001

 owprovui:
  public_env_variables:
+    DEFAULT_UCENTRALSEC_URL: http://localhost:16001
    REACT_APP_UCENTRALSEC_URL: http://localhost:16001

 kafka:
-  volumePermissions:
-    enabled: true
-  commonAnnotations:
-    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
+  heapOpts: -Xmx512m -Xms512m
  readinessProbe:
    initialDelaySeconds: 45
  livenessProbe:
    initialDelaySeconds: 60
-  kraft:
-    enabled: true
-  heapOpts: -Xmx1024m -Xms1024m
  zookeeper:
-    enabled: false
-  controller:
-    replicaCount: 1
-    extraConfig: |-
-      maxMessageBytes = 1048588
-      offsets.topic.replication.factor = 1
-      transaction.state.log.replication.factor = 1
-    extraEnvVars:
-      - name: ALLOW_PLAINTEXT_LISTENER
-        value: "yes"
-  listeners:
-    client:
-      protocol: PLAINTEXT
-      containerPort: 9092
-    controller:
-      protocol: "PLAINTEXT"
-  broker:
-    persistence:
-      size: 20Gi
-    replicaCount: 0
+    heapSize: 256
--- a/chart/environment-values/values.base.secure.yaml
+++ b/chart/environment-values/values.base.secure.yaml
@@ -298,54 +298,39 @@ owsub:
          secret:
            secretName: {{ include "owsub.fullname" . }}-owsub-restapi-tls

+owrrm:
+  public_env_variables:
+    SELFSIGNED_CERTS: "true"
+    KAFKACONFIG_BOOTSTRAPSERVER: kafka:9092
+    DATABASECONFIG_SERVER: owrrm-mysql:3306
+    DATABASECONFIG_DBNAME: owrrm
+    DATABASECONFIG_DATARETENTIONINTERVALDAYS: "1"
+
+  secret_env_variables:
+    DATABASECONFIG_USER: root
+    DATABASECONFIG_PASSWORD: openwifi
+
+  mysql:
+    enabled: true
+    fullnameOverride: "owrrm-mysql"
+
 owgwui:
  public_env_variables:
-    REACT_APP_UCENTRALSEC_URL: https://localhost:16001
+    DEFAULT_UCENTRALSEC_URL: https://localhost:16001

 owprovui:
  public_env_variables:
+    DEFAULT_UCENTRALSEC_URL: https://localhost:16001
    REACT_APP_UCENTRALSEC_URL: https://localhost:16001

 kafka:
-  volumePermissions:
-    enabled: true
-  commonAnnotations:
-    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
-  #resources:
-  #  requests:
-  #    cpu: 100m
-  #    memory: 512Mi
-  #  limits:
-  #    cpu: 500m
-  #    memory: 1Gi
+  heapOpts: -Xmx512m -Xms512m
  readinessProbe:
    initialDelaySeconds: 45
  livenessProbe:
    initialDelaySeconds: 60
-  kraft:
-    enabled: true
-  heapOpts: -Xmx1024m -Xms1024m
  zookeeper:
-    enabled: false
-  controller:
-    replicaCount: 1
-    extraConfig: |-
-      maxMessageBytes = 1048588
-      offsets.topic.replication.factor = 1
-      transaction.state.log.replication.factor = 1
-    extraEnvVars:
-      - name: ALLOW_PLAINTEXT_LISTENER
-        value: "yes"
-  listeners:
-    client:
-      protocol: PLAINTEXT
-      containerPort: 9092
-    controller:
-      protocol: "PLAINTEXT"
-  broker:
-    persistence:
-      size: 20Gi
-    replicaCount: 0
+    heapSize: 256

 restapiCerts:
  enabled: true
--- a/chart/environment-values/values.custom.tpl.yaml
+++ b/chart/environment-values/values.custom.tpl.yaml
@@ -1,132 +0,0 @@
-owgw:
-  services:
-    owgw:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: gw-${NAMESPACE}.${DOMAIN}
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
-  configProperties:
-    openwifi.fileuploader.host.0.name: gw-${NAMESPACE}.${DOMAIN}
-    rtty.server: gw-${NAMESPACE}.${DOMAIN}
-    openwifi.system.uri.public: https://gw-${NAMESPACE}.${DOMAIN}:16002
-    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owgw-owgw:17002
-    openwifi.system.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
-    iptocountry.ipinfo.token: "${IPTOCOUNTRY_IPINFO_TOKEN}"
-  public_env_variables:
-    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
-owsec:
-  configProperties:
-    authentication.default.username: "${OWGW_AUTH_USERNAME}"
-    authentication.default.password: "${OWGW_AUTH_PASSWORD}"
-    openwifi.system.uri.public: https://sec-${NAMESPACE}.${DOMAIN}:16001
-    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsec-owsec:17001
-    openwifi.ystem.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
-    mailer.sender: "sec-${NAMESPACE}@${DOMAIN}"
-    mailer.enabled: $MAILER_ENABLED
-    mailer.username: "$MAILER_USERNAME"
-    mailer.password: "$MAILER_PASSWORD"
-  services:
-    owsec:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: sec-${NAMESPACE}.${DOMAIN}
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
-owfms:
-  configProperties:
-    s3.secret: "${OWFMS_S3_SECRET}"
-    s3.key: "${OWFMS_S3_KEY}"
-    openwifi.system.uri.public: https://fms-${NAMESPACE}.${DOMAIN}:16004
-    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owfms-owfms:17004
-    openwifi.system.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
-  services:
-    owfms:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: fms-${NAMESPACE}.${DOMAIN}
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
-  public_env_variables:
-    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
-owprov:
-  services:
-    owprov:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: prov-${NAMESPACE}.${DOMAIN}
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
-  configProperties:
-    openwifi.system.uri.public: https://prov-${NAMESPACE}.${DOMAIN}:16005
-    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owprov-owprov:17005
-    openwifi.system.uri.ui: https://provui-${NAMESPACE}.${DOMAIN}
-    iptocountry.ipinfo.token: "${IPTOCOUNTRY_IPINFO_TOKEN}"
-  public_env_variables:
-    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
-owgwui:
-  ingresses:
-    default:
-      hosts:
-      - webui-${NAMESPACE}.${DOMAIN}
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: webui-${NAMESPACE}.${DOMAIN}
-        alb.ingress.kubernetes.io/certificate-arn: ${CERTIFICATE_ARN}
-  public_env_variables:
-    REACT_APP_UCENTRALSEC_URL: https://sec-${NAMESPACE}.${DOMAIN}:16001
-owprovui:
-  ingresses:
-    default:
-      hosts:
-      - provui-${NAMESPACE}.${DOMAIN}
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: provui-${NAMESPACE}.${DOMAIN}
-        alb.ingress.kubernetes.io/certificate-arn: ${CERTIFICATE_ARN}
-  public_env_variables:
-    REACT_APP_UCENTRALSEC_URL: https://sec-${NAMESPACE}.${DOMAIN}:16001
-owanalytics:
-  services:
-    owanalytics:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: analytics-${NAMESPACE}.${DOMAIN}
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
-  configProperties:
-    openwifi.system.uri.public: https://analytics-${NAMESPACE}.${DOMAIN}:16009
-    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owanalytics-owanalytics:17009
-    openwifi.system.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
-  public_env_variables:
-    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
-owsub:
-  services:
-    owsub:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: sub-${NAMESPACE}.${DOMAIN}
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
-  configProperties:
-    openwifi.system.uri.public: https://sub-${NAMESPACE}.${DOMAIN}:16006
-    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsub-owsub:17006
-    openwifi.system.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
-  public_env_variables:
-    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
-clustersysteminfo:
-  public_env_variables:
-    OWSEC: sec-${NAMESPACE}.${DOMAIN}:16001
-  secret_env_variables:
-    OWSEC_NEW_PASSWORD: "${OWSEC_NEW_PASSWORD}"
-owls:
-  services:
-    owls:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: ls-${NAMESPACE}.${DOMAIN}
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
-  configProperties:
-    openwifi.system.uri.public: https://ls-${NAMESPACE}.${DOMAIN}:16007
-    openwifi.system.uri.private: $INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owls-owls:17007
-    openwifi.system.uri.ui: https://webui-${NAMESPACE}.${DOMAIN}
-owlsui:
-  ingresses:
-    default:
-      hosts:
-      - lsui-${NAMESPACE}.${DOMAIN}
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: lsui-${NAMESPACE}.${DOMAIN}
-        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
-  public_env_variables:
-    REACT_APP_UCENTRALSEC_URL: https://sec-${NAMESPACE}.${DOMAIN}:16001
-haproxy:
-  service:
-    annotations:
-      external-dns.alpha.kubernetes.io/hostname: "$HAPROXY_SERVICE_DNS_RECORDS"
-      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${CERTIFICATE_ARN}
--- a/chart/environment-values/values.openwifi-qa.disable-radiusproxy.yaml
+++ b/chart/environment-values/values.openwifi-qa.disable-radiusproxy.yaml
@@ -1,7 +0,0 @@
-owgw:
-  configProperties:
-    radius.proxy.enable: "false"
-    radius.proxy.accounting.port: 1813
-    radius.proxy.authentication.port: 1812
-    radius.proxy.coa.port: 3799
-    radsec.keepalive: 120
--- a/chart/environment-values/values.openwifi-qa.owls-enabled.yaml
+++ b/chart/environment-values/values.openwifi-qa.owls-enabled.yaml
@@ -1,21 +1,48 @@
-# This helm values file is to be used when OWLS is run in the same namespace.
 owgw:
+  services:
+    owgw:
+      type: LoadBalancer
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-type: "nlb-ip"
+        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16102"
+        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003,17002"
+
  configProperties:
    simulatorid: 53494D020202
-    storage.type.postgresql.maxsessions: 120
-    # this actually disables websocket logging:
-    logging.websocket: true
+    storage.type: postgresql
+    storage.type.postgresql.host: owgw-pgsql
+    storage.type.postgresql.database: owgw
+    storage.type.postgresql.username: owgw
+    storage.type.postgresql.password: owgw

  resources:
    requests:
      cpu: 2000m
-      memory: 3Gi
+      memory: 3000Mi
    limits:
      cpu: 2000m
-      memory: 5Gi
+      memory: 3000Mi
+
+  postgresql:
+    enabled: true
+    fullnameOverride: owgw-pgsql
+
+    postgresqlDatabase: owgw
+    postgresqlUsername: owgw
+    postgresqlPassword: owgw

 owls:
  enabled: true
+
+  # NOTE this was added for debug purposes in WIFI-10926
+  images:
+    owls:
+      tag: 2c720c28a4a185404c81ca3b9027b28d3138b365
+  # NOTE end, delete all above up to the previous NOTE
+
  services:
    owls:
      type: LoadBalancer
@@ -24,6 +51,7 @@ owls:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16107"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16007,17007"
        external-dns.alpha.kubernetes.io/ttl: "60"

@@ -32,10 +60,10 @@ owls:

  resources:
    requests:
-      cpu: 6000m
+      cpu: 5000m
      memory: 8000Mi
    limits:
-      cpu: 6000m
+      cpu: 5000m
      memory: 8000Mi

  checks:
@@ -92,6 +120,7 @@ owls:
      - name: config
        mountPath: /owls-data/owls.properties
        subPath: owls.properties
+        # Template below will be rendered in template
        volumeDefinition: |
          secret:
            secretName: {{ include "owls.fullname" . }}-config
@@ -105,6 +134,7 @@ owls:
        volumeDefinition: |
          secret:
            secretName: {{ include "owls.fullname" . }}-certs-cas
+      # Change this if you want to use another volume type
      - name: persist
        mountPath: /owls-data/persist
        volumeDefinition: |
@@ -123,12 +153,13 @@ owls:
          secret:
            secretName: {{ include "owls.fullname" . }}-owls-restapi-tls

-
 owlsui:
  enabled: true
+
  services:
    owlsui:
      type: NodePort
+
  ingresses:
    default:
      enabled: true
@@ -136,6 +167,7 @@ owlsui:
        kubernetes.io/ingress.class: alb
        alb.ingress.kubernetes.io/scheme: internet-facing
        alb.ingress.kubernetes.io/group.name: wlan-cicd
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
        alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
        external-dns.alpha.kubernetes.io/ttl: "60"
--- a/chart/environment-values/values.openwifi-qa.owls-external.yaml
+++ b/chart/environment-values/values.openwifi-qa.owls-external.yaml
@@ -1,51 +0,0 @@
-# This helm values file is to be used when OWLS is run externally.
-owgw:
-  configProperties:
-    # done by default for owgw now:
-    #simulatorid: 53494D020202
-    # on a host with more CPUs you may need to bump this up from default of 64
-    storage.type.postgresql.maxsessions: 120
-    # this actually disables websocket logging:
-    logging.websocket: true
-    # consider lowering the # of days to keep archives in the database
-    #archiver.db.0.name = healthchecks
-    #archiver.db.0.keep = 1
-    #archiver.db.1.name = statistics
-    #archiver.db.1.keep = 1
-    #archiver.db.2.name = devicelogs
-    #archiver.db.2.keep = 1
-    #archiver.db.3.name = commandlist
-    #archiver.db.3.keep = 1
-
-  resources:
-    requests:
-      cpu: 2000m
-      memory: 3Gi
-    limits:
-      cpu: 2000m
-      memory: 5Gi
-
-owprov:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 200Mi
-    limits:
-      cpu: 100m
-      memory: 4Gi
-
-# Postgres tuning for larger # of APs
-#postgresql:
-#  primary:
-#    resourcesPreset: large
-#    persistence:
-#      size: 120Gi
-
-#kafka:
-#  controller:
-#    persistence:
-#      size: 80Gi
-#    extraConfig: |-
-#      # consider tuning this as otherwise kafka storage may be exceeded quickly
-#      # the default is 1 week!
-#      logRetentionHours = 24
--- a/chart/environment-values/values.openwifi-qa.separate-lbs.yaml
+++ b/chart/environment-values/values.openwifi-qa.separate-lbs.yaml
@@ -7,8 +7,8 @@ owgw:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16102"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
-        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003,17002,5913"
-        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16002,16003,17002,5912,5913"

 owsec:
  services:
@@ -19,8 +19,8 @@ owsec:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16101"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16001,17001"
-        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 owfms:
  services:
@@ -31,8 +31,8 @@ owfms:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16104"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004"
-        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 owprov:
  services:
@@ -43,8 +43,8 @@ owprov:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16105"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16005,17005"
-        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 owanalytics:
  services:
@@ -55,8 +55,8 @@ owanalytics:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16109"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16009,17009"
-        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 owsub:
  services:
@@ -67,8 +67,8 @@ owsub:
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16106"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16006,17006"
-        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=true

 haproxy:
  enabled: false
--- a/chart/environment-values/values.openwifi-qa.single-external-db.yaml
+++ b/chart/environment-values/values.openwifi-qa.single-external-db.yaml
@@ -1,8 +1,7 @@
 owgw:
  configProperties:
-    simulatorid: 53494D020202
    storage.type: postgresql
-    storage.type.postgresql.host: pgsql
+    storage.type.postgresql.host: pgsql-pgpool
    storage.type.postgresql.database: owgw
    storage.type.postgresql.username: owgw
    storage.type.postgresql.password: owgw
@@ -10,7 +9,7 @@ owgw:
 owsec:
  configProperties:
    storage.type: postgresql
-    storage.type.postgresql.host: pgsql
+    storage.type.postgresql.host: pgsql-pgpool
    storage.type.postgresql.database: owsec
    storage.type.postgresql.username: owsec
    storage.type.postgresql.password: owsec
@@ -18,7 +17,7 @@ owsec:
 owfms:
  configProperties:
    storage.type: postgresql
-    storage.type.postgresql.host: pgsql
+    storage.type.postgresql.host: pgsql-pgpool
    storage.type.postgresql.database: owfms
    storage.type.postgresql.username: owfms
    storage.type.postgresql.password: owfms
@@ -26,7 +25,7 @@ owfms:
 owprov:
  configProperties:
    storage.type: postgresql
-    storage.type.postgresql.host: pgsql
+    storage.type.postgresql.host: pgsql-pgpool
    storage.type.postgresql.database: owprov
    storage.type.postgresql.username: owprov
    storage.type.postgresql.password: owprov
@@ -34,7 +33,7 @@ owprov:
 owanalytics:
  configProperties:
    storage.type: postgresql
-    storage.type.postgresql.host: pgsql
+    storage.type.postgresql.host: pgsql-pgpool
    storage.type.postgresql.database: owanalytics
    storage.type.postgresql.username: owanalytics
    storage.type.postgresql.password: owanalytics
@@ -42,44 +41,15 @@ owanalytics:
 owsub:
  configProperties:
    storage.type: postgresql
-    storage.type.postgresql.host: pgsql
+    storage.type.postgresql.host: pgsql-pgpool
    storage.type.postgresql.database: owsub
    storage.type.postgresql.username: owsub
    storage.type.postgresql.password: owsub

-postgresql:
+postgresql-ha:
  enabled: true
  initDbScriptSecret:
    enabled: true
-    initdbScriptsSecret: tip-openwifi-initdb-scripts
-  volumePermissions:
-    enabled: true
-  global:
-    postgresql:
-      auth:
-        postgresPassword: postgres
-  auth:
-    postgresPassword: postgres
-  primary:
-    # TODO: tweak this next major release - 8Gi default is a bit too low
-    #persistence:
-    #  size: 30Gi
-    # Consider using this resource model for small installations
-    #resourcesPreset: medium
-    extendedConfiguration: |-
-      max_connections = 550
-      shared_buffers = 128MB
-    initdb:
-      scriptsSecret: tip-openwifi-initdb-scripts
-    # Consider using this disk size for small installations
-    #persistence:
-    #  size: 30Gi
-
-postgresql-ha:
-  enabled: false
-  initDbScriptSecret:
-    enabled: false
-    initdbScriptsSecret: tip-openwifi-initdb-scripts
  pgpool:
    adminPassword: admin
    resources:
@@ -91,12 +61,10 @@ postgresql-ha:
        memory: 1024Mi
    initdbScriptsSecret: tip-openwifi-initdb-scripts
  postgresql:
-    replicaCount: 1
-    password: postgres
+    replicaCount: 1 # TODO change after tests
+    password: password
    postgresPassword: postgres
    repmgrPassword: repmgr
-    maxConnections: 1000
-
    resources:
      requests:
        cpu: 250m
--- a/chart/environment-values/values.openwifi-qa.test-nodes.yaml
+++ b/chart/environment-values/values.openwifi-qa.test-nodes.yaml
@@ -112,7 +112,7 @@ owprovui:

 owls:
  nodeSelector:
-    env: owls
+    env: tests
  tolerations:
  - key: "tests"
    operator: "Exists"
@@ -188,6 +188,21 @@ owsub:
        operator: "Exists"
        effect: "NoSchedule"

+owrrm:
+  nodeSelector:
+    env: tests
+  tolerations:
+  - key: "tests"
+    operator: "Exists"
+    effect: "NoSchedule"
+  mysql:
+    nodeSelector:
+      env: tests
+    tolerations:
+    - key: "tests"
+      operator: "Exists"
+      effect: "NoSchedule"
+
 kafka:
  nodeSelector:
    env: tests
--- a/chart/environment-values/values.openwifi-qa.yaml
+++ b/chart/environment-values/values.openwifi-qa.yaml
@@ -17,20 +17,20 @@ owgw:
      cpu: 2000m
      memory: 2Gi

-#  securityContext:
-#    sysctls:
-#    - name: net.ipv4.tcp_keepalive_intvl
-#      value: "5"
-#    - name: net.ipv4.tcp_keepalive_probes
-#      value: "2"
-#    - name: net.ipv4.tcp_keepalive_time
-#      value: "45"
+  securityContext:
+    sysctls:
+    - name: net.ipv4.tcp_keepalive_intvl
+      value: "5"
+    - name: net.ipv4.tcp_keepalive_probes
+      value: "2"
+    - name: net.ipv4.tcp_keepalive_time
+      value: "45"

  podAnnotations:
    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"

-#  podSecurityPolicy:
-#    enabled: true
+  podSecurityPolicy:
+    enabled: true

  certs:
    restapi-ca.pem: |
@@ -314,7 +314,6 @@ owsec:
    openwifi.restapi.host.0.cert: $OWSEC_ROOT/certs/restapi-certs/tls.crt
    openwifi.restapi.host.0.key: $OWSEC_ROOT/certs/restapi-certs/tls.key
    mailer.hostname: email-smtp.us-east-2.amazonaws.com
-    openwifi.certificates.allowmismatch: "false"

  volumes:
    owsec:
@@ -357,9 +356,10 @@ owgwui:
    default:
      enabled: true
      annotations:
+        kubernetes.io/ingress.class: alb
        alb.ingress.kubernetes.io/scheme: internet-facing
        alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
        alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
      paths:
@@ -424,8 +424,6 @@ owfms:

  public_env_variables:
    SELFSIGNED_CERTS: "true"
-    # This has no effect as template based config is not enabled (see configProperties)
-    FIRMWAREDB_MAXAGE: "360"

  configProperties:
    openwifi.internal.restapi.host.0.rootca: $OWFMS_ROOT/certs/restapi-certs/ca.crt
@@ -434,7 +432,6 @@ owfms:
    openwifi.restapi.host.0.rootca: $OWFMS_ROOT/certs/restapi-certs/ca.crt
    openwifi.restapi.host.0.cert: $OWFMS_ROOT/certs/restapi-certs/tls.crt
    openwifi.restapi.host.0.key: $OWFMS_ROOT/certs/restapi-certs/tls.key
-    firmwaredb.maxage: 360

  volumes:
    owfms:
@@ -563,9 +560,10 @@ owprovui:
    default:
      enabled: true
      annotations:
+        kubernetes.io/ingress.class: alb
        alb.ingress.kubernetes.io/scheme: internet-facing
        alb.ingress.kubernetes.io/group.name: wlan-cicd
-        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:289708231103:certificate/2cc8c764-11fd-411d-bf7d-a93f488f3f6c
+        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
        alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_302"}}'
      paths:
@@ -742,55 +740,96 @@ owsub:
          secret:
            secretName: {{ include "owsub.fullname" . }}-owsub-restapi-tls

-kafka:
-  volumePermissions:
+owrrm:
+  fullnameOverride: owrrm
+
+  services:
+    owrrm:
+      type: LoadBalancer
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-type: "nlb-ip"
+        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+        service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "16789"
+        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
+        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16789,17007"
+
+  resources:
+    requests:
+      cpu: 1000m
+      memory: 2048Mi
+    limits:
+      cpu: 1000m
+      memory: 2048Mi
+
+  podAnnotations:
+    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
+
+  public_env_variables:
+    SELFSIGNED_CERTS: "true"
+    SERVICECONFIG_PRIVATEENDPOINT: http://owrrm-owrrm:16789
+    KAFKACONFIG_BOOTSTRAPSERVER: kafka:9092
+    DATABASECONFIG_SERVER: owrrm-mysql:3306
+    DATABASECONFIG_DBNAME: owrrm
+    DATABASECONFIG_DATARETENTIONINTERVALDAYS: "1"
+
+  secret_env_variables:
+    DATABASECONFIG_USER: root
+    DATABASECONFIG_PASSWORD: openwifi
+
+  volumes:
+    owrrm:
+      - name: persist
+        mountPath: /owrrm-data/
+        volumeDefinition: |
+          persistentVolumeClaim:
+            claimName: {{ template "owrrm.fullname" . }}-pvc
+
+      - name: restapi-ca
+        mountPath: /usr/local/share/ca-certificates/restapi-ca-selfsigned.crt
+        subPath: ca.crt
+        volumeDefinition: |
+          secret:
+            secretName: {{ include "owrrm.fullname" . }}-owrrm-restapi-tls
+
+  mysql:
    enabled: true
+    fullnameOverride: "owrrm-mysql"
+
+    resources:
+      requests:
+        cpu: 100m
+        memory: 512Mi
+      limits:
+        cpu: 100m
+        memory: 512Mi
+
+kafka:
  commonAnnotations:
    cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
+  heapOpts: -Xmx512m -Xms512m
+  resources:
+    requests:
+      cpu: 100m
+      memory: 512Mi
+    limits:
+      cpu: 500m
+      memory: 1Gi
  readinessProbe:
    initialDelaySeconds: 45
  livenessProbe:
    initialDelaySeconds: 60
-  heapOpts: -Xmx1024m -Xms1024m
-  kraft:
-    enabled: true
  zookeeper:
-    enabled: false
-  controller:
-    replicaCount: 1
-    persistence:
-      size: 20Gi
-    extraConfig: |-
-      maxMessageBytes = 1048588
-      offsets.topic.replication.factor = 1
-      transaction.state.log.replication.factor = 1
-    extraEnvVars:
-      - name: ALLOW_PLAINTEXT_LISTENER
-        value: "yes"
+    commonAnnotations:
+      cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
+    heapSize: 256
    resources:
      requests:
-        cpu: 500m
-        memory: 512Mi
+        cpu: 100m
+        memory: 256Mi
      limits:
-        cpu: 750m
-        memory: 2Gi
-  listeners:
-    client:
-      protocol: PLAINTEXT
-      containerPort: 9092
-    controller:
-      protocol: "PLAINTEXT"
-  broker:
-    persistence:
-      size: 20Gi
-    replicaCount: 0
-    resources:
-      requests:
-        cpu: 500m
-        memory: 512Mi
-      limits:
-        cpu: 750m
-        memory: 2Gi
+        cpu: 200m
+        memory: 384Mi

 clustersysteminfo:
  enabled: true
@@ -799,17 +838,18 @@ clustersysteminfo:
 haproxy:
  resources:
    requests:
-      cpu: 50m
-      memory: 50Mi
+      cpu: 10m
+      memory: 20Mi
    limits:
-      cpu: 50m
-      memory: 50Mi
+      cpu: 10m
+      memory: 20Mi
  service:
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl
      service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "8080"
      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004,16002,16003,17002,16005,17005,5913,16001,17001,16009,16006,17006"
+      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285
+      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16004,17004,16002,16003,17002,16005,17005,16001,17001,5912,5913,16009,16007,16006,17006"
      service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip

 restapiCerts:
--- a/chart/templates/_initdb_sql.tpl
+++ b/chart/templates/_initdb_sql.tpl
@@ -1,13 +0,0 @@
-{{- define "openwifi.user_creation_script_sql" -}}
-{{- $root := . -}}
-{{- $postgresqlBase := index .Values "postgresql" }}
-{{- $postgresqlEmulatedRoot := (dict "Values" $postgresqlBase "Chart" (dict "Name" "postgresql") "Release" $.Release) }}
-{{ range index .Values "postgresql" "initDbScriptSecret" "services" }}
-CREATE USER {{ index $root "Values" . "configProperties" "storage.type.postgresql.username" }};
-ALTER USER {{ index $root "Values" . "configProperties" "storage.type.postgresql.username" }} WITH ENCRYPTED PASSWORD '{{ index $root "Values" . "configProperties" "storage.type.postgresql.password" }}';
-CREATE DATABASE {{ index $root "Values" . "configProperties" "storage.type.postgresql.database" }};
-GRANT ALL PRIVILEGES ON DATABASE {{ index $root "Values" . "configProperties" "storage.type.postgresql.database" }} TO {{ index $root "Values" . "configProperties" "storage.type.postgresql.username" }};
-ALTER DATABASE {{ index $root "Values" . "configProperties" "storage.type.postgresql.database" }} OWNER TO {{ index $root "Values" . "configProperties" "storage.type.postgresql.username" }};
-{{ end }}
-{{- end -}}
-
--- a/chart/templates/secret-pgpool-initdb.yaml
+++ b/chart/templates/secret-pgpool-initdb.yaml
@@ -0,0 +1,16 @@
+{{- $root := . -}}
+{{- if index .Values "postgresql-ha" "initDbScriptSecret" "enabled" }}
+---
+apiVersion: v1
+metadata:
+  labels:
+    app.kuberentes.io/name: {{ include "openwifi.name" . }}
+    helm.sh/chart: {{ include "openwifi.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  name: {{ include "openwifi.fullname" . }}-initdb-scripts
+kind: Secret
+type: Opaque
+data:
+  users_creation.sh: {{ include "openwifi.user_creation_script" . | b64enc | quote }}
+{{- end }}
--- a/chart/templates/secret-postgresql-initdb.yaml
+++ b/chart/templates/secret-postgresql-initdb.yaml
@@ -1,31 +0,0 @@
-{{- $root := . -}}
-{{- if index .Values "postgresql-ha" "initDbScriptSecret" "enabled" }}
---
-apiVersion: v1
-metadata:
-  labels:
-    app.kubernetes.io/name: {{ include "openwifi.name" . }}
-    helm.sh/chart: {{ include "openwifi.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-  name: {{ include "openwifi.fullname" . }}-initdb-scripts
-kind: Secret
-type: Opaque
-data:
-  users_creation.sh: {{ include "openwifi.user_creation_script" . | b64enc | quote }}
-{{- end }}
-{{- if index .Values "postgresql" "initDbScriptSecret" "enabled" }}
---
-apiVersion: v1
-metadata:
-  labels:
-    app.kubernetes.io/name: {{ include "openwifi.name" . }}
-    helm.sh/chart: {{ include "openwifi.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-  name: {{ include "openwifi.fullname" . }}-initdb-scripts
-kind: Secret
-type: Opaque
-data:
-  initdb.sql: {{ include "openwifi.user_creation_script_sql" . | b64enc | quote }}
-{{- end }}
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -1,6 +1,7 @@
 # OpenWIFI Gateway (https://github.com/Telecominfraproject/wlan-cloud-ucentralgw/)
 owgw:
  fullnameOverride: owgw
+
  configProperties:
    openwifi.kafka.enable: "true"
    openwifi.kafka.brokerlist: kafka:9092
@@ -8,6 +9,7 @@ owgw:
 # OpenWIFI Security (https://github.com/Telecominfraproject/wlan-cloud-ucentralsec)
 owsec:
  fullnameOverride: owsec
+
  configProperties:
    openwifi.kafka.enable: "true"
    openwifi.kafka.brokerlist: kafka:9092
@@ -15,6 +17,7 @@ owsec:
 # OpenWIFI Firmware (https://github.com/Telecominfraproject/wlan-cloud-ucentralfms)
 owfms:
  fullnameOverride: owfms
+
  configProperties:
    openwifi.kafka.enable: "true"
    openwifi.kafka.brokerlist: kafka:9092
@@ -22,6 +25,7 @@ owfms:
 # OpenWIFI Provisioning (https://github.com/Telecominfraproject/wlan-cloud-owprov/)
 owprov:
  fullnameOverride: owprov
+
  configProperties:
    openwifi.kafka.enable: "true"
    openwifi.kafka.brokerlist: kafka:9092
@@ -29,6 +33,7 @@ owprov:
 # OpenWIFI Analytics (https://github.com/Telecominfraproject/wlan-cloud-analytics)
 owanalytics:
  fullnameOverride: owanalytics
+
  configProperties:
    openwifi.kafka.enable: "true"
    openwifi.kafka.brokerlist: kafka:9092
@@ -44,23 +49,43 @@ owprovui:
 # OpenWIFI Subscription (https://github.com/Telecominfraproject/wlan-cloud-userportal/)
 owsub:
  fullnameOverride: owsub
+
  configProperties:
    openwifi.kafka.enable: "true"
    openwifi.kafka.brokerlist: kafka:9092

+# OpenWIFI radio resource management (https://github.com/Telecominfraproject/wlan-cloud-rrm/)
+owrrm:
+  fullnameOverride: owrrm
+
+  mysql:
+    enabled: true
+
 # kafka (https://github.com/bitnami/charts/blob/master/bitnami/kafka/)
 kafka:
  enabled: true
+
  fullnameOverride: kafka

+  image:
+    registry: docker.io
+    repository: bitnami/kafka
+    tag: 2.8.0-debian-10-r43
+
+  minBrokerId: 100
+
+  zookeeper:
+    fullnameOverride: zookeeper
+
 # clustersysteminfo check
 clustersysteminfo:
  enabled: false
  delay: 0 # number of seconds to delay clustersysteminfo execution
+
  images:
    clustersysteminfo:
      repository: tip-tip-wlan-cloud-ucentral.jfrog.io/clustersysteminfo
-      tag: v3.2.0-RC3
+      tag: v2.7.2
      pullPolicy: Always
 #      regcred:
 #        registry: tip-tip-wlan-cloud-ucentral.jfrog.io
@@ -78,17 +103,23 @@ clustersysteminfo:
    # limits:
    #  cpu: 100m
    #  memory: 128Mi
+
  nodeSelector: {}
+
  tolerations: []
+
  affinity: {}
+
  public_env_variables:
    FLAGS: "-s --connect-timeout 3"
    OWSEC: owsec-owsec:16001
    CHECK_RETRIES: 30
+
  secret_env_variables:
    OWSEC_DEFAULT_USERNAME: tip@ucentral.com
    OWSEC_DEFAULT_PASSWORD: openwifi
    #OWSEC_NEW_PASSWORD: "" # Set this value in order for the check to work. Password must comply https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/#authenticationvalidationexpression
+
  activeDeadlineSeconds: 2400
  backoffLimit: 5
  restartPolicy: OnFailure
@@ -96,7 +127,9 @@ clustersysteminfo:
 # OpenWIFI Load Simulator (https://github.com/Telecominfraproject/wlan-cloud-owls)
 owls:
  enabled: false
+
  fullnameOverride: owls
+
  configProperties:
    openwifi.kafka.enable: "true"
    openwifi.kafka.brokerlist: kafka:9092
@@ -104,13 +137,17 @@ owls:
 # OpenWIFI Load Simulator UI (https://github.com/Telecominfraproject/wlan-cloud-owls-ui)
 owlsui:
  enabled: false
+
  fullnameOverride: owlsui

 # HAproxy (https://github.com/bitnami/charts/tree/master/bitnami/haproxy)
 haproxy:
  enabled: true
+
  fullnameOverride: proxy
-  replicaCount: 1
+
+  replicaCount: 3
+
  service:
    type: LoadBalancer
    ports:
@@ -391,6 +428,7 @@ haproxy:
 # Cert-manager RESTAPI certs
 restapiCerts:
  enabled: false
+
  services:
    - owgw-owgw
    - owsec-owsec
@@ -399,21 +437,9 @@ restapiCerts:
    - owls-owls
    - owanalytics-owanalytics
    - owsub-owsub
-  clusterDomain: cluster.local
+    - owrrm-owrrm

-postgresql:
-  enabled: false
-  nameOverride: pgsql
-  fullnameOverride: pgsql
-  initDbScriptSecret:
-    enabled: false
-    services:
-      - owgw
-      - owsec
-      - owfms
-      - owprov
-      - owanalytics
-      - owsub
+  clusterDomain: cluster.local

 postgresql-ha:
  enabled: false
--- a/docker-compose/.env
+++ b/docker-compose/.env
@@ -1,19 +1,19 @@
-COMPOSE_PROJECT_NAME=openwifi
-# set either default, selfsigned or letsencrypt
-DEPLOY_TYPE=default
-
 # Image tags
-OWGW_TAG=v3.2.0-RC3
-OWGWUI_TAG=v3.1.0
-OWSEC_TAG=v3.2.0-RC2
-OWFMS_TAG=v3.2.0-RC1
-OWPROV_TAG=v3.2.0-RC2
-OWPROVUI_TAG=v3.1.0
-OWANALYTICS_TAG=v3.2.0-RC2
-OWSUB_TAG=v3.2.0-RC1
-
-KAFKA_TAG=3.7-debian-12
+COMPOSE_PROJECT_NAME=openwifi
+OWGW_TAG=v2.7.2
+OWGWUI_TAG=v2.7.0
+OWSEC_TAG=v2.7.0
+OWFMS_TAG=v2.7.0
+OWPROV_TAG=v2.7.0
+OWPROVUI_TAG=v2.7.0
+OWANALYTICS_TAG=v2.7.0
+OWSUB_TAG=v2.7.0
+KAFKA_TAG=latest
+ZOOKEEPER_TAG=3.8
 POSTGRESQL_TAG=15.0
+MYSQL_TAG=latest
+# NOTE currently OWRRM is only supported in LB installations
+#OWRRM_TAG=v2.7.0

 # Microservice root/config directories
 OWGW_ROOT=/owgw-data
@@ -36,3 +36,4 @@ INTERNAL_OWFMS_HOSTNAME=owfms.wlan.local
 INTERNAL_OWPROV_HOSTNAME=owprov.wlan.local
 INTERNAL_OWANALYTICS_HOSTNAME=owanalytics.wlan.local
 INTERNAL_OWSUB_HOSTNAME=owsub.wlan.local
+#INTERNAL_OWRRM_HOSTNAME=owrrm.wlan.local
--- a/docker-compose/.env.letsencrypt
+++ b/docker-compose/.env.letsencrypt
@@ -1,19 +1,19 @@
-COMPOSE_PROJECT_NAME=openwifi
-
 # Image tags
-OWGW_TAG=v3.2.0-RC3
-OWGWUI_TAG=v3.1.0
-OWSEC_TAG=v3.2.0-RC2
-OWFMS_TAG=v3.2.0-RC1
-OWPROV_TAG=v3.2.0-RC2
-OWPROVUI_TAG=v3.1.0
-OWANALYTICS_TAG=v3.2.0-RC2
-OWSUB_TAG=v3.2.0-RC1
-
-KAFKA_TAG=3.7-debian-12
-POSTGRESQL_TAG=15.0
+COMPOSE_PROJECT_NAME=openwifi
+OWGW_TAG=v2.7.2
+OWGWUI_TAG=v2.7.0
+OWSEC_TAG=v2.7.0
+OWFMS_TAG=v2.7.0
+OWPROV_TAG=v2.7.0
+OWPROVUI_TAG=v2.7.0
+OWANALYTICS_TAG=v2.7.0
+OWSUB_TAG=v2.7.0
+OWRRM_TAG=v2.7.0
+KAFKA_TAG=latest
+ZOOKEEPER_TAG=3.8
 ACMESH_TAG=latest
-TRAEFIK_TAG=v3.1.0
+TRAEFIK_TAG=latest
+MYSQL_TAG=latest

 # Microservice root/config directories
 OWGW_ROOT=/owgw-data
@@ -39,5 +39,5 @@ INTERNAL_OWPROVUI_HOSTNAME=owprov-ui.wlan.local
 INTERNAL_OWANALYTICS_HOSTNAME=owanalytics.wlan.local
 INTERNAL_RTTYS_HOSTNAME=rttys.wlan.local
 INTERNAL_OWSUB_HOSTNAME=owsub.wlan.local
+INTERNAL_OWRRM_HOSTNAME=owrrm.wlan.local
 SDKHOSTNAME=
-#SDKHOSTNAME=openwifi.example.com
--- a/docker-compose/.env.selfsigned
+++ b/docker-compose/.env.selfsigned
@@ -1,19 +1,19 @@
-COMPOSE_PROJECT_NAME=openwifi
-
 # Image tags
-OWGW_TAG=v3.2.0-RC3
-OWGWUI_TAG=v3.1.0
-OWSEC_TAG=v3.2.0-RC2
-OWFMS_TAG=v3.2.0-RC1
-OWPROV_TAG=v3.2.0-RC2
-OWPROVUI_TAG=v3.1.0
-OWANALYTICS_TAG=v3.2.0-RC2
-OWSUB_TAG=v3.2.0-RC1
-
-KAFKA_TAG=3.7-debian-12
-POSTGRESQL_TAG=15.0
+COMPOSE_PROJECT_NAME=openwifi
+OWGW_TAG=v2.7.2
+OWGWUI_TAG=v2.7.0
+OWSEC_TAG=v2.7.0
+OWFMS_TAG=v2.7.0
+OWPROV_TAG=v2.7.0
+OWPROVUI_TAG=v2.7.0
+OWANALYTICS_TAG=v2.7.0
+OWSUB_TAG=v2.7.0
+OWRRM_TAG=v2.7.0
+KAFKA_TAG=latest
+ZOOKEEPER_TAG=3.8
 ACMESH_TAG=latest
 TRAEFIK_TAG=latest
+MYSQL_TAG=latest

 # Microservice root/config directories
 OWGW_ROOT=/owgw-data
@@ -38,3 +38,4 @@ INTERNAL_OWPROV_HOSTNAME=owprov.wlan.local
 INTERNAL_OWPROVUI_HOSTNAME=owprov-ui.wlan.local
 INTERNAL_OWANALYTICS_HOSTNAME=owanalytics.wlan.local
 INTERNAL_OWSUB_HOSTNAME=owsub.wlan.local
+INTERNAL_OWRRM_HOSTNAME=owrrm.wlan.local
--- a/docker-compose/README.md
+++ b/docker-compose/README.md
@@ -1,10 +1,10 @@
 # OpenWifi SDK Docker Compose
-
 ### Overview
 With the provided Docker Compose files you can instantiate a deployment of the OpenWifi microservices and related components. The repository contains a self-signed certificate and a TIP-signed gateway certificate which are valid for the `*.wlan.local` domain. You also have the possibility to either generate and use Let's Encrypt certs or provide your own certificates. Furthermore the deployments are split by whether Traefik is used as a reverse proxy/load balancer in front of the microservices or if they are exposed directly on the host. The advantage of using the deployments with Traefik is that you can use Let's Encrypt certs (automatic certificate generation and renewal) and you have the ability to scale specific containers to multiple replicas.
 The repository also contains a separate Docker Compose deployment to set up the [OWLS microservice](https://github.com/Telecominfraproject/wlan-cloud-owls) and related components for running a load simulation test against an existing controller.
 - [Non-LB deployment with self-signed certificates](#non-lb-deployment-with-self-signed-certificates)
 - [Non-LB deployment with own certificates](#non-lb-deployment-with-own-certificates)
+- [Non-LB deployment with PostgreSQL](#non-lb-deployment-with-postgresql)
 - [LB deployment with self-signed certificates](#lb-deployment-with-self-signed-certificates)
 - [LB deployment with Let's Encrypt certificates](#lb-deployment-with-letsencrypt-certificates)
 - [OWLS deployment with self-signed certificates](owls/README.md)
@@ -13,21 +13,92 @@ The repository also contains a separate Docker Compose deployment to set up the
 ### Configuration
 Config files for the microservices are generated on every startup based on the environment variables in the microservice specific env files. For an overview of the supported configuration properties have a look into these files. For an explanation of the configuration properties please see the README in the respective microservice repository.
 Be aware that local changes to the config files will be overwritten on every startup if `TEMPLATE_CONFIG` is set to `true` in the microservice env files. If you want to bind mount your own config file or make local changes, please set this variable to `false`.
-
 #### Required password changing on the first startup
 One important action that must be done before using the deployment is changing password for the default user in owsec as described in [owsec docs](https://github.com/Telecominfraproject/wlan-cloud-ucentralsec/tree/main#changing-default-password). Please use these docs to find the actions that must be done **after** the deployment in order to start using your deployment.
-
 ### Ports
 Every OpenWifi service is exposed via a separate port either directly on the host or through Traefik. For an overview of the exposed ports have a look into the deployment specific Docker Compose file. If you use your own certificates, you can also configure different hostnames for the microservices.
 Please note that the OWProv-UI is exposed on port `8080(HTTP)/8443(HTTPS)` by default.
-
 ### owsec templates and wwwassets
 On the startup of owsec directories for wwwassets and mailer templates are created from the base files included in Docker image. After the initial startup you may edit those files as you wish in the [owsec-data/persist](./owsec-data/persist) directory.
+## Non-LB deployment with self-signed certificates
+1. Switch into the project directory with `cd docker-compose/`.
+2. Add an entry for `openwifi.wlan.local` in your hosts file which points to `127.0.0.1` or whatever the IP of the host running the deployment is.
+3. Spin up the deployment with `docker-compose up -d`.
+4. Check if the containers are up and running with `docker-compose ps`.
+5. Add SSL certificate exceptions in your browser by visiting https://openwifi.wlan.local:16001, https://openwifi.wlan.local:16002, https://openwifi.wlan.local:16004, https://openwifi.wlan.local:16005, https://openwifi.wlan.local:16006 and https://openwifi.wlan.local:16009.
+6. Connect to your AP via SSH and add a static hosts entry in `/etc/hosts` for `openwifi.wlan.local`. This should point to the address of the host the Compose deployment runs on.
+7. Login to the UI `https://openwifi.wlan.local` and follow the instructions to change your default password.
+8. To use the curl test scripts included in the microservice repositories set the following environment variables:
+```
+export OWSEC="openwifi.wlan.local:16001"
+export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-compose/certs/restapi-ca.pem"
+```
+⚠️**Note**: When deploying with self-signed certificates you can not use the 'Trace' and 'Connect' features in the UI since the AP will throw a TLS error. Please use the Let's Encrypt deployment or provide your own valid certificates if you want to use these features.
+## Non-LB deployment with own certificates
+1. Switch into the project directory with `cd docker-compose/`. Copy your websocket and REST API certificates into the `certs/` directory. Make sure to reference the certificates accordingly in the service config if you use different file names or if you want to use different certificates for the respective microservices.
+2. Adapt the following hostname and URI variables according to your environment:
+### .env
+| Variable                        | Description                                                                        |
+| ------------------------------- | ---------------------------------------------------------------------------------- |
+| `INTERNAL_OWGW_HOSTNAME`        | Set this to your OWGW hostname, for example `owgw.example.com`.                    |
+| `INTERNAL_OWSEC_HOSTNAME`       | Set this to your OWSec hostname, for example `owsec.example.com`.                  |
+| `INTERNAL_OWFMS_HOSTNAME`       | Set this to your OWFms hostname, for example `owfms.example.com`.                  |
+| `INTERNAL_OWPROV_HOSTNAME`      | Set this to your OWProv hostname, for example `owprov.example.com`.                |
+| `INTERNAL_OWANALYTICS_HOSTNAME` | Set this to your OWAnalytics hostname, for example `owanalytics.example.com`.      |
+| `INTERNAL_OWSUB_HOSTNAME`       | Set this to your OWSub hostname, for example `owsub.example.com`.                  |
+| `INTERNAL_OWRRM_HOSTNAME`       | Set this to your OWRRM hostname, for example `owrrm.example.com`.                  |
+### owgw.env
+| Variable                                 | Description                                                                         |
+| ---------------------------------------- | ----------------------------------------------------------------------------------- |
+| `FILEUPLOADER_HOST_NAME`                 | Set this to your OWGW fileupload hostname, for example `owgw.example.com`.          |
+| `FILEUPLOADER_URI`                       | Set this to your OWGW fileupload URL, for example `https://owgw.example.com:16003`. |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWGW REST API URL, for example `https://owgw.example.com:16002`.   |
+| `RTTY_SERVER`                            | Set this to your OWGW RTTYS hostname, for example `owgw.example.com`.               |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
+### owgw-ui.env
+| Variable                  | Description                                                                |
+| ------------------------- | -------------------------------------------------------------------------- |
+| `DEFAULT_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
+### owsec.env
+| Variable                                 | Description                                                                         |
+| ---------------------------------------- | ----------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
+### owfms.env
+| Variable                                 | Description                                                                         |
+| ---------------------------------------- | ----------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWFms URL, for example `https://owfms.example.com:16004`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
+### owprov.env
+| Variable                                 | Description                                                                           |
+| ---------------------------------------- | ------------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWProv URL, for example `https://owprov.example.com:16005`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.              |
+### owprov-ui.env
+| Variable                    | Description                                                                |
+| --------------------------- | -------------------------------------------------------------------------- |
+| `REACT_APP_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
+### owanalytics.env
+| Variable                                 | Description                                                                            |
+| ---------------------------------------- | -------------------------------------------------------------------------------------- |
+| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWAnalytics URL, for example `https://owanalytics.example.com:16009`. |
+| `SYSTEM_URI_UI`                          | Set this to your OWProv-UI URL, for example `https://owprov-ui.example.com`.           |
+### owrrm.env
+| Variable                                 | Description                                                                                     |
+| ---------------------------------------- | ----------------------------------------------------------------------------------------------- |
+| `SERVICECONFIG_PRIVATEENDPOINT`, `SERVICECONFIG_PUBLICENDPOINT` | Set this to your OWRRM URL, for example https://owrrm.example.com:16789. |
+| `DATABASECONFIG_PASSWORD`                                       | Set this to a random and safe password.                                  |
+### mysql.env
+| Variable                                 | Description                                      |
+| ---------------- | ------------------------------------------------------------------------ |
+| `MYSQL_PASSWORD` | Set this to the same value as `$DATABASECONFIG_PASSWORD` in `owrrm.env`. |

-## PostgreSQL
-PostgreSQL is used by default for the database for all components.
-The following variables may be set in the env files. It is highly recommended that you change the DB passwords to some random string. The defaults are shown here.
-
+3. Spin up the deployment with `docker-compose up -d`.
+4. Check if the containers are up and running with `docker-compose ps`.
+5. Login to the UI and and follow the instructions to change your default password.
+## Non-LB deployment with PostgreSQL
+1. Switch into the project directory with `cd docker-compose/`.
+2. Set the following variables in the env files and make sure to uncomment the lines. It is highly recommended that you change the DB passwords to some random string.
 ### owgw.env
 | Variable                           | Value/Description |
 | ---------------------------------- | ----------------- |
@@ -36,7 +107,6 @@ The following variables may be set in the env files. It is highly recommended th
 | `STORAGE_TYPE_POSTGRESQL_USERNAME` | `owgw`            |
 | `STORAGE_TYPE_POSTGRESQL_PASSWORD` | `owgw`            |
 | `STORAGE_TYPE_POSTGRESQL_DATABASE` | `owgw`            |
-
 ### owsec.env
 | Variable                           | Value/Description |
 | ---------------------------------- | ----------------- |
@@ -45,7 +115,6 @@ The following variables may be set in the env files. It is highly recommended th
 | `STORAGE_TYPE_POSTGRESQL_USERNAME` | `owsec`           |
 | `STORAGE_TYPE_POSTGRESQL_PASSWORD` | `owsec`           |
 | `STORAGE_TYPE_POSTGRESQL_DATABASE` | `owsec`           |
-
 ### owfms.env
 | Variable                           | Value/Description |
 | ---------------------------------- | ----------------- |
@@ -54,7 +123,6 @@ The following variables may be set in the env files. It is highly recommended th
 | `STORAGE_TYPE_POSTGRESQL_USERNAME` | `owfms`           |
 | `STORAGE_TYPE_POSTGRESQL_PASSWORD` | `owfms`           |
 | `STORAGE_TYPE_POSTGRESQL_DATABASE` | `owfms`           |
-
 ### owprov.env
 | Variable                           | Value/Description |
 | ---------------------------------- | ----------------- |
@@ -63,7 +131,6 @@ The following variables may be set in the env files. It is highly recommended th
 | `STORAGE_TYPE_POSTGRESQL_USERNAME` | `owprov`          |
 | `STORAGE_TYPE_POSTGRESQL_PASSWORD` | `owprov`          |
 | `STORAGE_TYPE_POSTGRESQL_DATABASE` | `owprov`          |
-
 ### owanalytics.env
 | Variable                           | Value/Description |
 | ---------------------------------- | ----------------- |
@@ -72,7 +139,6 @@ The following variables may be set in the env files. It is highly recommended th
 | `STORAGE_TYPE_POSTGRESQL_USERNAME` | `owanalytics`     |
 | `STORAGE_TYPE_POSTGRESQL_PASSWORD` | `owanalytics`     |
 | `STORAGE_TYPE_POSTGRESQL_DATABASE` | `owanalytics`     |
-
 ### postgresql.env
 | Variable                  | Value         |
 | --------------------------| ------------- |
@@ -96,91 +162,13 @@ The following variables may be set in the env files. It is highly recommended th
 | `OWSUB_DB`                | `owsub`       |
 | `OWSUB_DB_USER`           | `owsub`       |
 | `OWSUB_DB_PASSWORD`       | `owsub`       |
-
-## Non-LB deployment with self-signed certificates
-1. Switch into the project directory with `cd docker-compose/`.
-2. Add an entry for `openwifi.wlan.local` in your hosts file which points to `127.0.0.1` or whatever the IP of the host running the deployment is.
-3. Spin up the deployment with `docker-compose up -d`.
-4. Check if the containers are up and running with `docker-compose ps`.
-5. Add SSL certificate exceptions in your browser by visiting https://openwifi.wlan.local:16001, https://openwifi.wlan.local:16002, https://openwifi.wlan.local:16004, https://openwifi.wlan.local:16005, https://openwifi.wlan.local:16006 and https://openwifi.wlan.local:16009.
-6. Connect to your AP via SSH and add a static hosts entry in `/etc/hosts` for `openwifi.wlan.local`. This should point to the address of the host the Compose deployment runs on.
-7. Login to the UI `https://openwifi.wlan.local` and follow the instructions to change your default password.
-8. To use the curl test scripts included in the microservice repositories set the following environment variables:
-```
-export OWSEC="openwifi.wlan.local:16001"
-export FLAGS="-s --cacert <your-wlan-cloud-ucentral-deploy-location>/docker-compose/certs/restapi-ca.pem"
-```
-⚠️**Note**: When deploying with self-signed certificates you can not use the 'Trace' and 'Connect' features in the UI since the AP will throw a TLS error. Please use the Let's Encrypt deployment or provide your own valid certificates if you want to use these features.
-
-## Non-LB deployment with own certificates
-1. Switch into the project directory with `cd docker-compose/`. Copy your websocket and REST API certificates into the `certs/` directory. Make sure to reference the certificates accordingly in the service config if you use different file names or if you want to use different certificates for the respective microservices.
-2. Adapt the following hostname and URI variables according to your environment:
-
-### .env
-| Variable                        | Description                                                                        |
-| ------------------------------- | ---------------------------------------------------------------------------------- |
-| `INTERNAL_OWGW_HOSTNAME`        | Set this to your OWGW hostname, for example `owgw.example.com`.                    |
-| `INTERNAL_OWSEC_HOSTNAME`       | Set this to your OWSec hostname, for example `owsec.example.com`.                  |
-| `INTERNAL_OWFMS_HOSTNAME`       | Set this to your OWFms hostname, for example `owfms.example.com`.                  |
-| `INTERNAL_OWPROV_HOSTNAME`      | Set this to your OWProv hostname, for example `owprov.example.com`.                |
-| `INTERNAL_OWANALYTICS_HOSTNAME` | Set this to your OWAnalytics hostname, for example `owanalytics.example.com`.      |
-| `INTERNAL_OWSUB_HOSTNAME`       | Set this to your OWSub hostname, for example `owsub.example.com`.                  |
-
-### owgw.env
-| Variable                                 | Description                                                                         |
-| ---------------------------------------- | ----------------------------------------------------------------------------------- |
-| `FILEUPLOADER_HOST_NAME`                 | Set this to your OWGW fileupload hostname, for example `owgw.example.com`.          |
-| `FILEUPLOADER_URI`                       | Set this to your OWGW fileupload URL, for example `https://owgw.example.com:16003`. |
-| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWGW REST API URL, for example `https://owgw.example.com:16002`.   |
-| `RTTY_SERVER`                            | Set this to your OWGW RTTYS hostname, for example `owgw.example.com`.               |
-| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
-
-### owgw-ui.env
-| Variable                    | Description                                                                |
-| --------------------------- | -------------------------------------------------------------------------- |
-| `REACT_APP_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
-
-### owsec.env
-| Variable                                 | Description                                                                         |
-| ---------------------------------------- | ----------------------------------------------------------------------------------- |
-| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
-| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
-
-### owfms.env
-| Variable                                 | Description                                                                         |
-| ---------------------------------------- | ----------------------------------------------------------------------------------- |
-| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWFms URL, for example `https://owfms.example.com:16004`. |
-| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.            |
-
-### owprov.env
-| Variable                                 | Description                                                                           |
-| ---------------------------------------- | ------------------------------------------------------------------------------------- |
-| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWProv URL, for example `https://owprov.example.com:16005`. |
-| `SYSTEM_URI_UI`                          | Set this to your OWGW-UI URL, for example `https://owgw-ui.example.com`.              |
-
-### owprov-ui.env
-| Variable                    | Description                                                                |
-| --------------------------- | -------------------------------------------------------------------------- |
-| `REACT_APP_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://owsec.example.com:16001`. |
-
-### owanalytics.env
-| Variable                                 | Description                                                                            |
-| ---------------------------------------- | -------------------------------------------------------------------------------------- |
-| `SYSTEM_URI_PRIVATE`,`SYSTEM_URI_PUBLIC` | Set this to your OWAnalytics URL, for example `https://owanalytics.example.com:16009`. |
-| `SYSTEM_URI_UI`                          | Set this to your OWProv-UI URL, for example `https://owprov-ui.example.com`.           |
-
-3. Spin up the deployment with `docker-compose up -d`.
-4. Check if the containers are up and running with `docker-compose ps`.
-5. Login to the UI and and follow the instructions to change your default password.
-
+3. Depending on whether you want to use [self-signed certificates](#non-lb-deployment-with-self-signed-certificates) or [provide your own](#non-lb-deployment-with-own-certificates), follow the instructions of the according deployment model. Spin up the deployment with `docker-compose -f docker-compose.yml -f docker-compose.postgresql.yml up -d`. It is recommended to create an alias for this deployment model with `alias docker-compose-postgresql="docker-compose -f docker-compose.yml -f docker-compose.postgresql.yml"`.
 ## LB deployment with self-signed certificates
 Follow the same instructions as for the self-signed deployment without Traefik. The only difference is that you have to spin up the deployment with `docker-compose -f docker-compose.lb.selfsigned.yml --env-file .env.selfsigned up -d`. Make sure to specify the Compose and the according .env file every time you're working with the deployment or create an alias, for example `alias docker-compose-lb-selfsigned="docker-compose -f docker-compose.lb.selfsigned.yml --env-file .env.selfsigned"`. You also have the possibility to scale specific services to a specified number of instances with `docker-compose-lb-selfsigned up -d --scale SERVICE=NUM`, where `SERVICE` is the service name as defined in the Compose file.
-
 ## LB deployment with Let's Encrypt certificates
 For the Let's Encrypt challenge to work you need a public IP address. The hostname which you set in the `$SDKHOSTNAME` env variable has to resolve to this IP address to pass the HTTP-01 challenge (https://letsencrypt.org/docs/challenge-types/#http-01-challenge).
 1. Switch into the project directory with `cd docker-compose/`.
 2. Adapt the following hostname and URI variables according to your environment.
-
 ### .env.letsencrypt
 | Variable      | Description                                                                                                |
 | ------------- | ---------------------------------------------------------------------------------------------------------- |
@@ -196,9 +184,9 @@ For the Let's Encrypt challenge to work you need a public IP address. The hostna
 | `SYSTEM_URI_UI`          | Set this to your OWGW-UI URL, for example `https://openwifi.example.com`.               |

 ### owgw-ui.env
-| Variable                    | Description                                                                   |
-| --------------------------- | ----------------------------------------------------------------------------- |
-| `REACT_APP_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://openwifi.example.com:16001`. |
+| Variable            | Description                                                                   |
+| ------------------- | ----------------------------------------------------------------------------- |
+| `DEFAULT_OWSEC_URL` | Set this to your OWSec URL, for example `https://openwifi.example.com:16001`. |

 ### owsec.env
 | Variable            | Description                                                                   |
@@ -211,31 +199,34 @@ For the Let's Encrypt challenge to work you need a public IP address. The hostna
 | ------------------- | ----------------------------------------------------------------------------- |
 | `SYSTEM_URI_PUBLIC` | Set this to your OWFms URL, for example `https://openwifi.example.com:16004`. |
 | `SYSTEM_URI_UI`     | Set this to your OWGW-UI URL, for example `https://openwifi.example.com`.     |
-
 ### owprov.env
-| Variable             | Description                                                                    |
+| Variable             | Description                                                                    | 
 | -------------------- | ------------------------------------------------------------------------------ |
 | `SYSTEM_URI_PUBLIC`  | Set this to your OWProv URL, for example `https://openwifi.example.com:16005`. |
 | `SYSTEM_URI_UI`      | Set this to your OWGW-UI URL, for example `https://openwifi.example.com`.      |
-
 ### owprov-ui.env
 | Variable                    | Description                                                                   |
 | --------------------------- | ----------------------------------------------------------------------------- |
 | `REACT_APP_UCENTRALSEC_URL` | Set this to your OWSec URL, for example `https://openwifi.example.com:16001`. |
-
 ### owanalytics.env
 | Variable             | Description                                                                         |
 | -------------------- | ----------------------------------------------------------------------------------- |
 | `SYSTEM_URI_PUBLIC`  | Set this to your OWAnalytics URL, for example `https://openwifi.example.com:16009`. |
 | `SYSTEM_URI_UI`      | Set this to your OWProv-UI URL, for example `https://openwifi.example.com`.         |
-
 ### owsub.env
 | Variable             | Description                                                                   |
 | -------------------- | ----------------------------------------------------------------------------- |
 | `SYSTEM_URI_PUBLIC`  | Set this to your OWSub URL, for example `https://openwifi.example.com:16006`. |
-
 | `SYSTEM_URI_UI`      | Set this to your OWGW-UI URL, for example `https://openwifi.example.com`.     |
-
+### owrrm.env
+| Variable                                 | Description                     |
+| ---------------------------------------- | ------------------------------- |
+| `SERVICECONFIG_PUBLICENDPOINT`   | Set this to your OWRRM URL, for example https://openwifi.example.com:16789. |
+| `DATABASECONFIG_PASSWORD`        | Set this to a random and safe password.                                     |
+### mysql.env
+| Variable         | Description                                                              |
+| ---------------- | ------------------------------------------------------------------------ |
+| `MYSQL_PASSWORD` | Set this to the same value as `$DATABASECONFIG_PASSWORD` in `owrrm.env`. |
 ### traefik.env
 | Variable                                            | Description                               |
 | --------------------------------------------------- | ----------------------------------------- |
--- a/docker-compose/cloudformation/openwifi-cloudsdk-docker-compose.yml
+++ b/docker-compose/cloudformation/openwifi-cloudsdk-docker-compose.yml
@@ -57,7 +57,7 @@ Parameters:
  ExistingHostedZoneId:
    Description: |
      If you want to create the Route53 record in an existing hosted zone,
-      please specify the according hosted zone ID.
+      please specify the according hosted zone ID. 
    Type: String
 #    MinLength: 21
 #    MaxLength: 21
@@ -205,6 +205,8 @@ Resources:
                docker-compose.lb.letsencrypt.yml --env-file .env.letsencrypt"
                alias docker-compose-lb-selfsigned="docker-compose -f \
                docker-compose.lb.selfsigned.yml --env-file .env.selfsigned"
+                alias docker-compose-postgresql="docker-compose -f \
+                docker-compose.yml -f docker-compose.postgresql.yml"
              mode: "000644"
              owner: "root"
              group: "root"
@@ -233,6 +235,8 @@ Resources:
                OWPROV_SYSTEM_URI_PUBLIC: !Sub "https://${SDKHostname}:16005"
                OWANALYTICS_SYSTEM_URI_PUBLIC: !Sub "https://${SDKHostname}:16009"
                OWSUB_SYSTEM_URI_PUBLIC: !Sub "https://${SDKHostname}:16006"
+                OWRRM_SERVICECONFIG_PRIVATEENDPOINT: !Sub "http://owrrm.wlan.local:17007"
+                OWRRM_SERVICECONFIG_PUBLICENDPOINT: !Sub "https://${SDKHostname}:16789"
                TRAEFIK_ACME_EMAIL: !Sub "${TraefikAcmeEmail}"
              cwd: "~/wlan-cloud-ucentral-deploy/docker-compose"
    Properties:
@@ -289,6 +293,10 @@ Resources:
          FromPort: "16009"
          ToPort: "16009"
          CidrIp: 0.0.0.0/0
+        - IpProtocol: tcp
+          FromPort: "16789"
+          ToPort: "16789"
+          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: "5912"
          ToPort: "5913"
@@ -300,7 +308,7 @@ Resources:
  CloudSDKHostedZone:
    Condition: HasHostedZoneName
    Type: AWS::Route53::HostedZone
-    Properties:
+    Properties: 
      Name: !Ref HostedZoneName
  CloudSDKRoute53RecordExistingHostedZone:
    Condition: CreateRecordInExistingZone
--- a/docker-compose/dco
+++ b/docker-compose/dco
@@ -1,32 +0,0 @@
-#!/bin/bash
-# Wrapper around docker-compose that will use the correct command line options
-# depending on what type of setup you have.
-# It captures $1 == clean and performs cleanup of the volumes and data directories,
-# It captures $1 == launch or l and runs: ... up -d,
-# but passes everything else straight to the docker-compose command.
-cmd="docker-compose"
-deploy_type=$(grep "^DEPLOY_TYPE=" .env | awk -F= '{ print $2 }')
-[ -z "$deploy_type" ] && deploy_type="default"
-if [[ "$deploy_type" == "letsencrypt" ]] ; then
-    cmd="$cmd -f docker-compose.lb.letsencrypt.yml --env-file .env.letsencrypt"
-elif [[ "$deploy_type" == "selfsigned" ]] ; then
-    cmd="$cmd -f docker-compose.lb.selfsigned.yml --env-file .env.selfsigned"
-elif [[ "$deploy_type" == "default" ]] ; then
-    # ok
-    true
-else
-    echo "Invalid DEPLOY_TYPE: $deploy_type"
-    echo "Should be one of: default, letsencrypt or selfsigned"
-    exit 1
-fi
-if [[ "$1" == "clean" ]] ; then
-    set -x
-    $cmd down -v
-    rm -rf *_data
-elif [[ "$1" == "launch" || "$1" == "l" ]] ; then
-    set -x
-    $cmd up -d
-else
-    set -x
-    $cmd "$@"
-fi
--- a/docker-compose/deploy.sh
+++ b/docker-compose/deploy.sh
@@ -39,6 +39,9 @@ usage () {
 #  echo "- OWSUB_SYSTEM_URI_PRIVATE - private URL to be used for OWSub";
  echo "- OWSUB_SYSTEM_URI_PUBLIC - public URL to be used for OWSub";
  echo;
+  echo "- OWRRM_SERVICECONFIG_PRIVATEENDPOINT - private URL to be used for OWRRM";
+  echo "- OWRRM_SERVICECONFIG_PUBLICENDPOINT - public URL to be used for OWRRM";
+  echo;
  echo "Optional environment variables:"
  echo "- WEBSOCKET_CERT - Your Digicert-signed websocket certificate"
  echo "- WEBSOCKET_KEY - The key to your Digicert-signed websocket certificate"
@@ -50,10 +53,7 @@ usage () {
  echo "- OWFMS_S3_KEY - access key that is used for OWFms access to firmwares S3 bucket";
  echo;
  echo "- SDKHOSTNAME - Public hostname which is used for cert generation when using the Letsencrypt deployment method"
-  echo;
  echo "- TRAEFIK_ACME_EMAIL - Email address used for ACME registration"
-  echo;
-  echo "- CERTIFICATES_ALLOWMISMATCH - boolean flag to allow certificates serial mismatch";
 }

 # Check if required environment variables were passed
@@ -88,6 +88,9 @@ usage () {
 ## OWSub configuration variables
 #[ -z ${OWSUB_SYSTEM_URI_PRIVATE+x} ] && echo "OWSUB_SYSTEM_URI_PRIVATE is unset" && usage && exit 1
 [ -z ${OWSUB_SYSTEM_URI_PUBLIC+x} ] && echo "OWSUB_SYSTEM_URI_PUBLIC is unset" && usage && exit 1
+## OWRRM configuration variables
+[ -z ${OWRRM_SERVICECONFIG_PRIVATEENDPOINT+x} ] && echo "OWRRM_SERVICECONFIG_PRIVATEENDPOINT is unset" && usage && exit 1
+[ -z ${OWRRM_SERVICECONFIG_PUBLICENDPOINT+x} ] && echo "OWRRM_SERVICECONFIG_PUBLICENDPOINT is unset" && usage && exit 1

 # Search and replace image version tags if set
 if [[ ! -z "$OWGW_VERSION" ]]; then
@@ -139,7 +142,7 @@ if [[ ! -z "$SIMULATORID" ]]; then
  sed -i "s~.*SIMULATORID=.*~SIMULATORID=$SIMULATORID~" owgw.env
 fi

-sed -i "s~.*REACT_APP_UCENTRALSEC_URL=.*~REACT_APP_UCENTRALSEC_URL=$DEFAULT_UCENTRALSEC_URL~" owgw-ui.env
+sed -i "s~.*DEFAULT_UCENTRALSEC_URL=.*~DEFAULT_UCENTRALSEC_URL=$DEFAULT_UCENTRALSEC_URL~" owgw-ui.env

 if [[ ! -z "$OWSEC_AUTHENTICATION_DEFAULT_USERNAME" ]]; then
  sed -i "s~.*AUTHENTICATION_DEFAULT_USERNAME=.*~AUTHENTICATION_DEFAULT_USERNAME=$OWSEC_AUTHENTICATION_DEFAULT_USERNAME~" owsec.env
@@ -175,14 +178,13 @@ sed -i "s~.*SYSTEM_URI_UI=.*~SYSTEM_URI_UI=$SYSTEM_URI_UI~" owanalytics.env
 sed -i "s~.*SYSTEM_URI_PUBLIC=.*~SYSTEM_URI_PUBLIC=$OWSUB_SYSTEM_URI_PUBLIC~" owsub.env
 sed -i "s~.*SYSTEM_URI_UI=.*~SYSTEM_URI_UI=$SYSTEM_URI_UI~" owsub.env

+sed -i "s~.*SERVICECONFIG_PRIVATEENDPOINT=.*~SERVICECONFIG_PRIVATEENDPOINT=$OWRRM_SERVICECONFIG_PRIVATEENDPOINT~" owrrm.env
+sed -i "s~.*SERVICECONFIG_PUBLICENDPOINT=.*~SERVICECONFIG_PUBLICENDPOINT=$OWRRM_SERVICECONFIG_PUBLICENDPOINT~" owrrm.env
+
 if [[ ! -z "$TRAEFIK_ACME_EMAIL" ]]; then
  sed -i "s~.*TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_EMAIL=.*~TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_EMAIL=$TRAEFIK_ACME_EMAIL~" traefik.env
 fi

-if [[ ! -z "$CERTIFICATES_ALLOWMISMATCH" ]]; then
-  sed -i "s~.*CERTIFICATES_ALLOWMISMATCH=.*~CERTIFICATES_ALLOWMISMATCH=$CERTIFICATES_ALLOWMISMATCH~" owgw.env
-fi
-
 # Run the deployment
 if [[ ! -z "$SDKHOSTNAME" ]]; then
  docker-compose -f docker-compose.lb.letsencrypt.yml --env-file .env.letsencrypt up -d
--- a/docker-compose/docker-compose.lb.letsencrypt.yml
+++ b/docker-compose/docker-compose.lb.letsencrypt.yml
@@ -1,3 +1,5 @@
+version: '3'
+
 volumes:
  owgw_data:
    driver: local
@@ -11,9 +13,15 @@ volumes:
    driver: local
  owsub_data:
    driver: local
+  owrrm_data:
+    driver: local
+  zookeeper_data:
+    driver: local
+  zookeeper_datalog:
+    driver: local
  kafka_data:
    driver: local
-  postgresql_data:
+  mysql_data:
    driver: local
  letsencrypt_certs:
    driver: local
@@ -32,11 +40,7 @@ services:
      - .env.letsencrypt
      - owgw.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owgw"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owgw_data:${OWGW_ROOT}/persist
@@ -71,11 +75,7 @@ services:
      - .env.letsencrypt
      - owsec.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsec"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owsec_data:${OWSEC_ROOT}/persist
@@ -91,11 +91,7 @@ services:
      - .env.letsencrypt
      - owfms.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owfms"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owfms_data:${OWFMS_ROOT}/persist
@@ -111,11 +107,7 @@ services:
      - .env.letsencrypt
      - owprov.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owprov"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owprov_data:${OWPROV_ROOT}
@@ -146,11 +138,7 @@ services:
      - .env.letsencrypt
      - owanalytics.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owanalytics"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owanalytics_data:${OWANALYTICS_ROOT}
@@ -166,16 +154,36 @@ services:
      - .env.letsencrypt
      - owsub.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsub"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owsub_data:${OWSUB_ROOT}
      - ./certs:/${OWSUB_ROOT}/certs

+  owrrm:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owrrm:${OWRRM_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWRRM_HOSTNAME}
+    env_file:
+      - owrrm.env
+    depends_on:
+      - mysql
+      - kafka
+    restart: unless-stopped
+    volumes:
+      - owrrm_data:/owrrm-data
+
+  zookeeper:
+    image: "zookeeper:${ZOOKEEPER_TAG}"
+    networks:
+      openwifi:
+    restart: unless-stopped
+    volumes:
+      - zookeeper_data:/data
+      - zookeeper_datalog:/datalog
+
  kafka:
    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
    networks:
@@ -183,6 +191,8 @@ services:
    env_file:
      - kafka.env
    restart: unless-stopped
+    depends_on:
+      - zookeeper
    volumes:
      - kafka_data:/bitnami/kafka

@@ -198,8 +208,6 @@ services:
      - /bin/sh
      - -c
      - |
-        echo "Sleeping to allow kafka to start up..."
-        sleep 10
        echo "Creating all required Kafka topics..."
        for topic in $$TOPICS; do
          /opt/bitnami/kafka/bin/kafka-topics.sh \
@@ -207,6 +215,16 @@ services:
          --partitions 1 --bootstrap-server kafka:9092
        done && echo "Successfully created Kafka topics, exiting." && exit 0

+  mysql:
+    image: "mysql:${MYSQL_TAG}"
+    networks:
+      openwifi:
+    env_file:
+      - mysql.env
+    restart: unless-stopped
+    volumes:
+      - mysql_data:/var/lib/mysql
+
  traefik:
    image: "traefik:${TRAEFIK_TAG}"
    networks:
@@ -223,6 +241,7 @@ services:
      - owprov-ui
      - owanalytics
      - owsub
+      - owrrm
    restart: unless-stopped
    volumes:
      - "./traefik/openwifi_letsencrypt.yaml:/etc/traefik/openwifi.yaml"
@@ -249,30 +268,7 @@ services:
      - "16006:16006"
      - "5912:5912"
      - "5913:5913"
+      - "16789:16789"
      - "1812:1812/udp"
      - "1813:1813/udp"
      - "3799:3799/udp"
-
-  postgresql:
-    image: "postgres:${POSTGRESQL_TAG}"
-    networks:
-      openwifi:
-    command:
-      - "postgres"
-      - "-c"
-      - "max_connections=400"
-      - "-c"
-      - "shared_buffers=20MB"
-    env_file:
-      - postgresql.env
-    restart: unless-stopped
-    volumes:
-      - postgresql_data:/var/lib/postgresql/data
-      - ./postgresql/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh
-    healthcheck:
-      # owsub is the last DB created in init-db.sh
-      test: ["CMD-SHELL", "pg_isready -U postgres -d owsub"]
-      interval: 10s
-      retries: 5
-      start_period: 30s
-      timeout: 10s
--- a/docker-compose/docker-compose.lb.selfsigned.yml
+++ b/docker-compose/docker-compose.lb.selfsigned.yml
@@ -1,3 +1,5 @@
+version: '3'
+
 volumes:
  owgw_data:
    driver: local
@@ -11,9 +13,15 @@ volumes:
    driver: local
  owsub_data:
    driver: local
+  owrrm_data:
+    driver: local
+  zookeeper_data:
+    driver: local
+  zookeeper_datalog:
+    driver: local
  kafka_data:
    driver: local
-  postgresql_data:
+  mysql_data:
    driver: local

 networks:
@@ -30,11 +38,7 @@ services:
      - .env.selfsigned
      - owgw.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owgw"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owgw_data:${OWGW_ROOT}/persist
@@ -46,6 +50,8 @@ services:

  owgw-ui:
    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owgw-ui:${OWGWUI_TAG}"
+    env_file: 
+      - owgw-ui.env
    networks:
      openwifi:
        aliases:
@@ -69,11 +75,7 @@ services:
      - .env.selfsigned
      - owsec.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsec"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owsec_data:${OWSEC_ROOT}/persist
@@ -89,11 +91,7 @@ services:
      - .env.selfsigned
      - owfms.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owfms"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owfms_data:${OWFMS_ROOT}/persist
@@ -109,11 +107,7 @@ services:
      - .env.selfsigned
      - owprov.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owprov"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owprov_data:${OWPROV_ROOT}
@@ -144,11 +138,7 @@ services:
      - .env.selfsigned
      - owanalytics.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owanalytics"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owanalytics_data:${OWANALYTICS_ROOT}
@@ -164,16 +154,36 @@ services:
      - .env.selfsigned
      - owsub.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsub"]
+      - kafka
    restart: unless-stopped
    volumes:
      - owsub_data:${OWSUB_ROOT}
      - ./certs:/${OWSUB_ROOT}/certs

+  owrrm:
+    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owrrm:${OWRRM_TAG}"
+    networks:
+      openwifi:
+        aliases:
+          - ${INTERNAL_OWRRM_HOSTNAME}
+    env_file:
+      - owrrm.env
+    depends_on:
+      - mysql
+      - kafka
+    restart: unless-stopped
+    volumes:
+      - owrrm_data:/owrrm-data
+
+  zookeeper:
+    image: "zookeeper:${ZOOKEEPER_TAG}"
+    networks:
+      openwifi:
+    restart: unless-stopped
+    volumes:
+      - zookeeper_data:/data
+      - zookeeper_datalog:/datalog
+
  kafka:
    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
    networks:
@@ -181,6 +191,8 @@ services:
    env_file:
      - kafka.env
    restart: unless-stopped
+    depends_on:
+      - zookeeper
    volumes:
      - kafka_data:/bitnami/kafka

@@ -196,8 +208,6 @@ services:
      - /bin/sh
      - -c
      - |
-        echo "Sleeping to allow kafka to start up..."
-        sleep 10
        echo "Creating all required Kafka topics..."
        for topic in $$TOPICS; do
          /opt/bitnami/kafka/bin/kafka-topics.sh \
@@ -205,6 +215,16 @@ services:
          --partitions 1 --bootstrap-server kafka:9092
        done && echo "Successfully created Kafka topics, exiting." && exit 0

+  mysql:
+    image: "mysql:${MYSQL_TAG}"
+    networks:
+      openwifi:
+    env_file:
+      - mysql.env
+    restart: unless-stopped
+    volumes:
+      - mysql_data:/var/lib/mysql
+
  traefik:
    image: "traefik:${TRAEFIK_TAG}"
    networks:
@@ -220,6 +240,7 @@ services:
      - owprov-ui
      - owanalytics
      - owsub
+      - owrrm
    restart: unless-stopped
    volumes:
      - "./traefik/openwifi_selfsigned.yaml:/etc/traefik/openwifi.yaml"
@@ -241,30 +262,7 @@ services:
      - "16006:16006"
      - "5912:5912"
      - "5913:5913"
+      - "16789:16789"
      - "1812:1812/udp"
      - "1813:1813/udp"
      - "3799:3799/udp"
-
-  postgresql:
-    image: "postgres:${POSTGRESQL_TAG}"
-    networks:
-      openwifi:
-    command:
-      - "postgres"
-      - "-c"
-      - "max_connections=400"
-      - "-c"
-      - "shared_buffers=20MB"
-    env_file:
-      - postgresql.env
-    restart: unless-stopped
-    volumes:
-      - postgresql_data:/var/lib/postgresql/data
-      - ./postgresql/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh
-    healthcheck:
-      # owsub is the last DB created in init-db.sh
-      test: ["CMD-SHELL", "pg_isready -U postgres -d owsub"]
-      interval: 10s
-      retries: 5
-      start_period: 30s
-      timeout: 10s
--- a/docker-compose/docker-compose.postgresql.yml
+++ b/docker-compose/docker-compose.postgresql.yml
@@ -0,0 +1,47 @@
+version: '3'
+
+volumes:
+  postgresql_data:
+    driver: local
+
+services:
+  owgw:
+    depends_on:
+      - postgresql
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owgw"]
+
+  owsec:
+    depends_on:
+      - postgresql
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsec"]
+
+  owfms:
+    depends_on:
+      - postgresql
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owfms"]
+
+  owprov:
+    depends_on:
+      - postgresql
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owprov"]
+
+  owanalytics:
+    depends_on:
+      - postgresql
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owanalytics"]
+
+  owsub:
+    depends_on:
+      - postgresql
+    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsub"]
+
+  postgresql:
+    image: "postgres:${POSTGRESQL_TAG}"
+    networks:
+      openwifi:
+    env_file:
+      - postgresql.env
+    restart: unless-stopped
+    volumes:
+      - postgresql_data:/var/lib/postgresql/data
+      - ./postgresql/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh
--- a/docker-compose/docker-compose.yml
+++ b/docker-compose/docker-compose.yml
@@ -1,7 +1,15 @@
+version: '3'
+
 volumes:
+#  owrrm_data:
+#    driver: local
+  zookeeper_data:
+    driver: local
+  zookeeper_datalog:
+    driver: local
  kafka_data:
    driver: local
-  postgresql_data:
+  mysql_data:
    driver: local

 networks:
@@ -17,11 +25,7 @@ services:
    env_file:
      - owgw.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owgw"]
+      - kafka
    restart: unless-stopped
    volumes:
      - "./owgw_data:${OWGW_ROOT}"
@@ -72,11 +76,7 @@ services:
    env_file:
      - owsec.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsec"]
+      - kafka
    restart: unless-stopped
    volumes:
      - "./owsec_data:${OWSEC_ROOT}"
@@ -94,11 +94,7 @@ services:
    env_file:
      - owfms.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owfms"]
+      - kafka
    restart: unless-stopped
    volumes:
      - "./owfms_data:${OWFMS_ROOT}"
@@ -116,11 +112,7 @@ services:
    env_file:
      - owprov.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owprov"]
+      - kafka
    restart: unless-stopped
    volumes:
      - "./owprov_data:${OWPROV_ROOT}"
@@ -160,11 +152,7 @@ services:
    env_file:
      - owanalytics.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owanalytics"]
+      - kafka
    restart: unless-stopped
    volumes:
      - "./owanalytics_data:${OWANALYTICS_ROOT}"
@@ -182,11 +170,7 @@ services:
    env_file:
      - owsub.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
-      postgresql:
-        condition: service_healthy
-    command: ["./wait-for-postgres.sh", "postgresql", "/openwifi/owsub"]
+      - kafka
    restart: unless-stopped
    volumes:
      - "./owsub_data:${OWSUB_ROOT}"
@@ -195,6 +179,33 @@ services:
      - "16006:16006"
      - "16106:16106"

+# NOTE currently OWRRM is only supported in LB installations
+#  owrrm:
+#    image: "tip-tip-wlan-cloud-ucentral.jfrog.io/owrrm:${OWRRM_TAG}"
+#    networks:
+#      openwifi:
+#        aliases:
+#          - ${INTERNAL_OWRRM_HOSTNAME}
+#    env_file:
+#      - owrrm.env
+#    depends_on:
+#      - mysql
+#      - kafka
+#    restart: unless-stopped
+#    volumes:
+#      - owrrm_data:/owrrm-data
+#    ports:
+#      - "16789:16789"
+
+  zookeeper:
+    image: "zookeeper:${ZOOKEEPER_TAG}"
+    networks:
+      openwifi:
+    restart: unless-stopped
+    volumes:
+      - zookeeper_data:/data
+      - zookeeper_datalog:/datalog
+
  kafka:
    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
    networks:
@@ -202,6 +213,8 @@ services:
    env_file:
      - kafka.env
    restart: unless-stopped
+    depends_on:
+      - zookeeper
    volumes:
      - kafka_data:/bitnami/kafka

@@ -217,8 +230,6 @@ services:
      - /bin/sh
      - -c
      - |
-        echo "Sleeping to allow kafka to start up..."
-        sleep 10
        echo "Creating all required Kafka topics..."
        for topic in $$TOPICS; do
          /opt/bitnami/kafka/bin/kafka-topics.sh \
@@ -226,26 +237,12 @@ services:
          --partitions 1 --bootstrap-server kafka:9092
        done && echo "Successfully created Kafka topics, exiting." && exit 0

-  postgresql:
-    image: "postgres:${POSTGRESQL_TAG}"
+  mysql:
+    image: "mysql:${MYSQL_TAG}"
    networks:
      openwifi:
-    command:
-      - "postgres"
-      - "-c"
-      - "max_connections=400"
-      - "-c"
-      - "shared_buffers=20MB"
    env_file:
-      - postgresql.env
+      - mysql.env
    restart: unless-stopped
    volumes:
-      - postgresql_data:/var/lib/postgresql/data
-      - ./postgresql/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh
-    healthcheck:
-      # owsub is the last DB created in init-db.sh
-      test: ["CMD-SHELL", "pg_isready -U postgres -d owsub"]
-      interval: 10s
-      retries: 5
-      start_period: 30s
-      timeout: 10s
+      - mysql_data:/var/lib/mysql
--- a/docker-compose/kafka.env
+++ b/docker-compose/kafka.env
@@ -1,10 +1,3 @@
+KAFKA_CFG_ZOOKEEPER_CONNECT=zookeeper:2181
 ALLOW_PLAINTEXT_LISTENER=yes
-TOPICS=command connection device_event_queue device_telemetry healthcheck provisioning_change service_events state wifiscan
-KAFKA_CFG_NODE_ID=0
-KAFKA_CFG_PROCESS_ROLES=controller,broker
-KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=0@kafka:9093
-KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,CONTROLLER://:9093
-KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://:9092
-KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT
-KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER
-KAFKA_CFG_INTER_BROKER_LISTENER_NAME=PLAINTEXT
+TOPICS=command connection device_event_queue device telemetry healthcheck provisioning_change service_events state wifiscan
--- a/docker-compose/mysql.env
+++ b/docker-compose/mysql.env
@@ -0,0 +1,5 @@
+#MYSQL_RANDOM_ROOT_PASSWORD=yes
+MYSQL_ROOT_PASSWORD=openwifi
+MYSQL_DATABASE=owrrm
+#MYSQL_USER=owrrm
+#MYSQL_PASSWORD=openwifi
--- a/docker-compose/owanalytics.env
+++ b/docker-compose/owanalytics.env
@@ -23,19 +23,17 @@ SYSTEM_DATA=$OWANALYTICS_ROOT/persist
 SYSTEM_URI_PRIVATE=https://owanalytics.wlan.local:17009
 SYSTEM_URI_PUBLIC=https://openwifi.wlan.local:16009
 SYSTEM_URI_UI=https://openwifi.wlan.local
-
 #SECURITY_RESTAPI_DISABLE=false
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
-STORAGE_TYPE=postgresql
-STORAGE_TYPE_POSTGRESQL_HOST=postgresql
-STORAGE_TYPE_POSTGRESQL_USERNAME=owanalytics
-STORAGE_TYPE_POSTGRESQL_PASSWORD=owanalytics
-STORAGE_TYPE_POSTGRESQL_DATABASE=owanalytics
-STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE=sqlite
+#STORAGE_TYPE_POSTGRESQL_HOST=localhost
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owanalytics
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owanalytics
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owanalytics
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owanalytics
 #STORAGE_TYPE_MYSQL_PASSWORD=owanalytics
 #STORAGE_TYPE_MYSQL_DATABASE=owanalytics
 #STORAGE_TYPE_MYSQL_PORT=3306
-#STORAGE_TYPE=sqlite
--- a/docker-compose/owfms.env
+++ b/docker-compose/owfms.env
@@ -29,15 +29,14 @@ S3_KEY=AKIAUG47UZG7R6SRLD7F
 #S3_BUCKET_URI=ucentral-ap-firmware.s3.amazonaws.com
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
-STORAGE_TYPE=postgresql
-STORAGE_TYPE_POSTGRESQL_HOST=postgresql
-STORAGE_TYPE_POSTGRESQL_USERNAME=owfms
-STORAGE_TYPE_POSTGRESQL_PASSWORD=owfms
-STORAGE_TYPE_POSTGRESQL_DATABASE=owfms
-STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE=sqlite
+#STORAGE_TYPE_POSTGRESQL_HOST=localhost
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owfms
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owfms
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owfms
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owfms
 #STORAGE_TYPE_MYSQL_PASSWORD=owfms
 #STORAGE_TYPE_MYSQL_DATABASE=owfms
 #STORAGE_TYPE_MYSQL_PORT=3306
-#STORAGE_TYPE=sqlite
--- a/docker-compose/owgw-ui.env
+++ b/docker-compose/owgw-ui.env
@@ -1 +1,2 @@
-REACT_APP_UCENTRALSEC_URL=https://openwifi.wlan.local:16001
+DEFAULT_UCENTRALSEC_URL=https://openwifi.wlan.local:16001
+ALLOW_UCENTRALSEC_CHANGE=false
--- a/docker-compose/owgw.env
+++ b/docker-compose/owgw.env
@@ -56,17 +56,14 @@ RADIUS_PROXY_ENABLE=true
 #RADIUS_PROXY_COA_PORT=3799
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
-STORAGE_TYPE=postgresql
-STORAGE_TYPE_POSTGRESQL_HOST=postgresql
-STORAGE_TYPE_POSTGRESQL_USERNAME=owgw
-STORAGE_TYPE_POSTGRESQL_PASSWORD=owgw
-STORAGE_TYPE_POSTGRESQL_DATABASE=owgw
-STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE=sqlite
+#STORAGE_TYPE_POSTGRESQL_HOST=localhost
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owgw
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owgw
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owgw
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owgw
 #STORAGE_TYPE_MYSQL_PASSWORD=owgw
 #STORAGE_TYPE_MYSQL_DATABASE=owgw
 #STORAGE_TYPE_MYSQL_PORT=3306
-#STORAGE_TYPE=sqlite
-
-#CERTIFICATES_ALLOWMISMATCH=false
--- a/docker-compose/owls/.env
+++ b/docker-compose/owls/.env
@@ -1,14 +1,10 @@
-COMPOSE_PROJECT_NAME=owls
-
 # Image tags
-# Currently main branches don't work - owlsui is not compatible with owls.
-#OWSEC_TAG=main
-#OWLS_TAG=main
-#OWLSUI_TAG=master
-OWSEC_TAG=v2.9.0
-OWLS_TAG=v2.9.0
-OWLSUI_TAG=v2.9.0
-KAFKA_TAG=3.7-debian-12
+COMPOSE_PROJECT_NAME=owls
+OWSEC_TAG=main
+OWLS_TAG=main
+OWLSUI_TAG=master
+KAFKA_TAG=latest
+ZOOKEEPER_TAG=latest

 # Microservice root/config directories
 OWSEC_ROOT=/owsec-data
--- a/docker-compose/owls/README.md
+++ b/docker-compose/owls/README.md
@@ -1,6 +1,6 @@
 # OpenWifi OWLS Docker Compose
 ## Deployment with self-signed certificates
-To run a load simulation you need to generate a specific Digicert-signed AP certificate which will be used to connect to the gateway. The certificate serial number has to start with the digits `53494d` since otherwise the gateway won't allow a load simulation. The rest of the serial number and the specified redirector URL can be chosen randomly. You only need to generate one AP certificate for your simulations.
+To run a load simulation you need to generate a specific Digicert-signed AP certificate which will be used to connect to the gateway. The certificate serial number has to start with the digits `53494d` since otherwise the gateway won't allow a load simulation. The rest of the serial number and the specified redirector URL can be chosen randomly. You only need to generate one AP certificate for your simulations.  
 Be aware that since the OWLS deployment partly exposes the same ports on the host as the OpenWifi deployment, it is not intended that both run on the same host.
 1. Copy or move your AP load simulation certificate into the `docker-compose/certs` directory. Don't forget to name the files `device-cert.pem` and `device-key.pem` or adapt the path names in the OWLS configuration if you're using different file names.
 2. To be able to run load simulation tests against your OpenWifi SDK deployment, you'll have to [add the serial number of your generated AP certificate to the gateway configuration](https://github.com/Telecominfraproject/wlan-cloud-owls#prepare-your-openwifi-gateway). You can do that by either editing [owgw.env](../owgw.env) or doing the changes directly in your OWGW configuration file if it is exposed on your Docker host.
--- a/docker-compose/owls/deploy_owls.sh
+++ b/docker-compose/owls/deploy_owls.sh
@@ -57,7 +57,7 @@ cd wlan-cloud-ucentral-deploy/docker-compose/owls
 sed -i "s~\(^INTERNAL_OWSEC_HOSTNAME=\).*~\1$INTERNAL_OWSEC_HOSTNAME~" .env
 sed -i "s~\(^INTERNAL_OWLS_HOSTNAME=\).*~\1$INTERNAL_OWLS_HOSTNAME~" .env

-sed -i "s~\(^REACT_APP_UCENTRALSEC_URL=\).*~\1$DEFAULT_UCENTRALSEC_URL~" owls-ui.env
+sed -i "s~\(^DEFAULT_UCENTRALSEC_URL=\).*~\1$DEFAULT_UCENTRALSEC_URL~" owls-ui.env

 sed -i "s~.*AUTHENTICATION_DEFAULT_USERNAME=.*~AUTHENTICATION_DEFAULT_USERNAME=$OWSEC_AUTHENTICATION_DEFAULT_USERNAME~" owsec.env
 sed -i "s~.*AUTHENTICATION_DEFAULT_PASSWORD=.*~AUTHENTICATION_DEFAULT_PASSWORD=$OWSEC_AUTHENTICATION_DEFAULT_PASSWORD~" owsec.env
--- a/docker-compose/owls/docker-compose.yml
+++ b/docker-compose/owls/docker-compose.yml
@@ -1,4 +1,10 @@
+version: '3'
+
 volumes:
+  zookeeper_data:
+    driver: local
+  zookeeper_datalog:
+    driver: local
  kafka_data:
    driver: local

@@ -15,8 +21,7 @@ services:
    env_file:
      - owsec.env
    depends_on:
-      init-kafka:
-        condition: service_completed_successfully
+      - kafka
    restart: unless-stopped
    volumes:
      - "./owsec_data:${OWSEC_ROOT}"
@@ -34,10 +39,8 @@ services:
    env_file:
      - owls.env
    depends_on:
-      owsec:
-        condition: service_started
-      init-kafka:
-        condition: service_completed_successfully
+      - owsec
+      - kafka
    restart: unless-stopped
    volumes:
      - "./owls_data:${OWLS_ROOT}"
@@ -64,6 +67,15 @@ services:
      - "80:80"
      - "443:443"

+  zookeeper:
+    image: "zookeeper:${ZOOKEEPER_TAG}"
+    networks:
+      owls:
+    restart: unless-stopped
+    volumes:
+      - zookeeper_data:/data
+      - zookeeper_datalog:/datalog
+
  kafka:
    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
    networks:
@@ -71,26 +83,7 @@ services:
    env_file:
      - kafka.env
    restart: unless-stopped
+    depends_on:
+      - zookeeper
    volumes:
      - kafka_data:/bitnami/kafka
-
-  init-kafka:
-    image: "docker.io/bitnami/kafka:${KAFKA_TAG}"
-    networks:
-      owls:
-    depends_on:
-      - kafka
-    env_file:
-      - kafka.env
-    entrypoint:
-      - /bin/sh
-      - -c
-      - |
-        echo "Sleeping to allow kafka to start up..."
-        sleep 10
-        echo "Creating all required Kafka topics..."
-        for topic in $$TOPICS; do
-          /opt/bitnami/kafka/bin/kafka-topics.sh \
-          --create --if-not-exists --topic $$topic --replication-factor 1 \
-          --partitions 1 --bootstrap-server kafka:9092
-        done && echo "Successfully created Kafka topics, exiting." && exit 0
--- a/docker-compose/owls/kafka.env
+++ b/docker-compose/owls/kafka.env
@@ -1,10 +1,2 @@
+KAFKA_CFG_ZOOKEEPER_CONNECT=zookeeper:2181
 ALLOW_PLAINTEXT_LISTENER=yes
-TOPICS=service_events
-KAFKA_CFG_NODE_ID=0
-KAFKA_CFG_PROCESS_ROLES=controller,broker
-KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=0@kafka:9093
-KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,CONTROLLER://:9093
-KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://:9092
-KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT
-KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER
-KAFKA_CFG_INTER_BROKER_LISTENER_NAME=PLAINTEXT
--- a/docker-compose/owls/owls-ui.env
+++ b/docker-compose/owls/owls-ui.env
@@ -1 +1,2 @@
-REACT_APP_UCENTRALSEC_URL=https://openwifi.wlan.local:16001
+DEFAULT_UCENTRALSEC_URL=https://openwifi-owls.wlan.local:16001
+ALLOW_UCENTRALSEC_CHANGE=false
--- a/docker-compose/owprov.env
+++ b/docker-compose/owprov.env
@@ -26,15 +26,14 @@ SYSTEM_URI_UI=https://openwifi.wlan.local
 #SECURITY_RESTAPI_DISABLE=false
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
-STORAGE_TYPE=postgresql
-STORAGE_TYPE_POSTGRESQL_HOST=postgresql
-STORAGE_TYPE_POSTGRESQL_USERNAME=owprov
-STORAGE_TYPE_POSTGRESQL_PASSWORD=owprov
-STORAGE_TYPE_POSTGRESQL_DATABASE=owprov
-STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE=sqlite
+#STORAGE_TYPE_POSTGRESQL_HOST=localhost
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owprov
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owprov
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owprov
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owprov
 #STORAGE_TYPE_MYSQL_PASSWORD=owprov
 #STORAGE_TYPE_MYSQL_DATABASE=owprov
 #STORAGE_TYPE_MYSQL_PORT=3306
-#STORAGE_TYPE=sqlite
--- a/docker-compose/owrrm.env
+++ b/docker-compose/owrrm.env
@@ -0,0 +1,8 @@
+SELFSIGNED_CERTS=true
+SERVICECONFIG_PRIVATEENDPOINT=https://owrrm.wlan.local:16789
+SERVICECONFIG_PUBLICENDPOINT=https://openwifi.wlan.local:16789
+KAFKACONFIG_BOOTSTRAPSERVER=kafka:9092
+DATABASECONFIG_SERVER=mysql:3306
+DATABASECONFIG_USER=root
+#DATABASECONFIG_PASSWORD=openwifi
+DATABASECONFIG_DBNAME=owrrm
--- a/docker-compose/owsec.env
+++ b/docker-compose/owsec.env
@@ -35,15 +35,14 @@ SYSTEM_URI_UI=https://openwifi.wlan.local
 KAFKA_BROKERLIST=kafka:9092
 #DOCUMENT_POLICY_ACCESS=$OWSEC_ROOT/wwwassets/access_policy.html
 #DOCUMENT_POLICY_PASSWORD=$OWSEC_ROOT/wwwassets/password_policy.html
-STORAGE_TYPE=postgresql
-STORAGE_TYPE_POSTGRESQL_HOST=postgresql
-STORAGE_TYPE_POSTGRESQL_USERNAME=owsec
-STORAGE_TYPE_POSTGRESQL_PASSWORD=owsec
-STORAGE_TYPE_POSTGRESQL_DATABASE=owsec
-STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE=sqlite
+#STORAGE_TYPE_POSTGRESQL_HOST=localhost
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owsec
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owsec
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owsec
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owsec
 #STORAGE_TYPE_MYSQL_PASSWORD=owsec
 #STORAGE_TYPE_MYSQL_DATABASE=owsec
 #STORAGE_TYPE_MYSQL_PORT=3306
-#STORAGE_TYPE=sqlite
--- a/docker-compose/owsub.env
+++ b/docker-compose/owsub.env
@@ -26,15 +26,14 @@ SYSTEM_URI_UI=https://openwifi.wlan.local
 #SECURITY_RESTAPI_DISABLE=false
 #KAFKA_ENABLE=true
 KAFKA_BROKERLIST=kafka:9092
-STORAGE_TYPE=postgresql
-STORAGE_TYPE_POSTGRESQL_HOST=postgresql
-STORAGE_TYPE_POSTGRESQL_USERNAME=owsub
-STORAGE_TYPE_POSTGRESQL_PASSWORD=owsub
-STORAGE_TYPE_POSTGRESQL_DATABASE=owsub
-STORAGE_TYPE_POSTGRESQL_PORT=5432
+#STORAGE_TYPE=sqlite
+#STORAGE_TYPE_POSTGRESQL_HOST=localhost
+#STORAGE_TYPE_POSTGRESQL_USERNAME=owsub
+#STORAGE_TYPE_POSTGRESQL_PASSWORD=owsub
+#STORAGE_TYPE_POSTGRESQL_DATABASE=owsub
+#STORAGE_TYPE_POSTGRESQL_PORT=5432
 #STORAGE_TYPE_MYSQL_HOST=localhost
 #STORAGE_TYPE_MYSQL_USERNAME=owsub
 #STORAGE_TYPE_MYSQL_PASSWORD=owsub
 #STORAGE_TYPE_MYSQL_DATABASE=owsub
 #STORAGE_TYPE_MYSQL_PORT=3306
-#STORAGE_TYPE=sqlite
--- a/docker-compose/traefik.env
+++ b/docker-compose/traefik.env
@@ -17,6 +17,7 @@ TRAEFIK_ENTRYPOINTS_OWFMSRESTAPI_ADDRESS=:16004
 TRAEFIK_ENTRYPOINTS_OWPROVRESTAPI_ADDRESS=:16005
 TRAEFIK_ENTRYPOINTS_OWANALYTICSRESTAPI_ADDRESS=:16009
 TRAEFIK_ENTRYPOINTS_OWSUBRESTAPI_ADDRESS=:16006
+TRAEFIK_ENTRYPOINTS_OWRRMOPENAPI_ADDRESS=:16789
 TRAEFIK_PROVIDERS_FILE_FILENAME=/etc/traefik/openwifi.yaml
 TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_EMAIL=
 TRAEFIK_CERTIFICATESRESOLVERS_OPENWIFI_ACME_HTTPCHALLENGE=true
--- a/docker-compose/traefik/openwifi_letsencrypt.yaml
+++ b/docker-compose/traefik/openwifi_letsencrypt.yaml
@@ -40,6 +40,10 @@ http:
      loadBalancer:
        servers:
          - url: "https://owgw.wlan.local:5913/"
+    owrrm-openapi:
+      loadBalancer:
+        servers:
+          - url: "http://owrrm.wlan.local:16789/"

  routers:
    owgw-ui-http:
@@ -110,6 +114,12 @@ http:
      rule: "Host(`{{env "SDKHOSTNAME"}}`)"
      tls:
        certResolver: "openwifi"
+    owrrm-openapi:
+      entryPoints: "owrrmopenapi"
+      service: "owrrm-openapi"
+      rule: "Host(`{{env "SDKHOSTNAME"}}`)"
+      tls:
+        certResolver: "openwifi"

 tcp:
  services:
--- a/docker-compose/traefik/openwifi_selfsigned.yaml
+++ b/docker-compose/traefik/openwifi_selfsigned.yaml
@@ -15,6 +15,11 @@ http:
        servers:
          - url: "http://owprov-ui.wlan.local:80/"

+    owrrm-openapi:
+      loadBalancer:
+        servers:
+          - url: "http://owrrm.wlan.local:16789/"
+
  routers:
    owgw-ui-http:
      entryPoints: "owgwuihttp"
@@ -38,6 +43,12 @@ http:
      rule: "PathPrefix(`/`)"
      tls: {}

+    owrrm-openapi:
+      entryPoints: "owrrmopenapi"
+      service: "owrrm-openapi"
+      rule: "PathPrefix(`/`)"
+      tls: {}
+
 tcp:
  services:
    owgw-websocket:
Author	SHA1	Message	Date
TIP Automation User	81508bca0d	Chg: update image tag in helm values to v2.7.2	2022-11-04 17:19:04 +00:00
TIP Automation User	57bc2259b1	Chg: update image tag in helm values to v2.7.2-RC1	2022-11-01 20:43:04 +00:00
Johann Hoffmann	5b29c58ba1	Set fixed PostgreSQL image version tag Signed-off-by: Johann Hoffmann <johann.hoffmann@mailbox.org>	2022-10-27 10:22:29 +02:00
Johann Hoffmann	3543923705	Increase OWGW memory limit on QA instance Signed-off-by: Johann Hoffmann <johann.hoffmann@mailbox.org>	2022-10-21 14:22:24 +02:00
TIP Automation User	19cacadd89	Chg: update image tag in helm values to v2.7.1	2022-10-19 23:07:53 +00:00
Johann Hoffmann	cee6714170	Create databases with microservice role as owner Signed-off-by: Johann Hoffmann <johann.hoffmann@mailbox.org>	2022-10-19 11:48:20 +02:00
TIP Automation User	3453774813	Chg: update image tag in helm values to v2.7.1-RC2	2022-10-14 19:15:07 +00:00
Johann Hoffmann	1e29c88713	Fix typo in postgresql.env Signed-off-by: Johann Hoffmann <johann.hoffmann@mailbox.org>	2022-10-14 14:58:39 +02:00
TIP Automation User	38346dd4a8	Chg: update image tag in helm values to v2.7.1-RC1	2022-10-12 09:14:06 +00:00
Dmitry Dunaev	ffde193610	Merge branch 'main' into release/v2.7.0	2022-10-12 12:11:09 +03:00
Dmitry Dunaev	fc3e1dfd40	[WIFI-10926] Chg: OWLS CPU limits Signed-off-by: Dmitry Dunaev <dmitry@opsfleet.com>	2022-10-05 15:08:38 +03:00
Johann Hoffmann	3e0ddf869d	Pin zookeeper Docker image version in other Compose deployments as well Signed-off-by: Johann Hoffmann <johann.hoffmann@mailbox.org>	2022-10-05 13:55:49 +02:00
TIP Automation User	7b4ead75d0	Chg: update image tag in helm values to v2.7.0	2022-10-05 11:33:18 +00:00
TIP Automation User	cc1180478f	Chg: update image tag in helm values to v2.7.0-RC7	2022-10-05 02:46:22 +00:00
TIP Automation User	80d745b7e2	Chg: update image tag in helm values to v2.7.0-RC6	2022-10-03 11:14:36 +00:00
Dmitry Dunaev	188493459d	Merge pull request #107 from Telecominfraproject/main [WIFI-10581] Backport main into release/2.7.0	2022-10-03 14:10:41 +03:00
TIP Automation User	cbb8072d42	Chg: update image tag in helm values to v2.7.0-RC5	2022-10-01 00:58:26 +00:00
TIP Automation User	4c41175770	Chg: update image tag in helm values to v2.7.0-RC4	2022-09-30 19:49:07 +00:00
TIP Automation User	4039605e05	Chg: update image tag in helm values to v2.7.0-RC3	2022-09-30 16:31:47 +00:00
TIP Automation User	1b6e24e539	Chg: update image tag in helm values to v2.7.0-RC2	2022-09-29 23:27:55 +00:00
TIP Automation User	f69300d464	Chg: update image tag in helm values to v2.7.0-RC1	2022-09-16 19:55:16 +00:00