Merge pull request #59 from Telecominfraproject/feature/wifi-7437--no-tls-values

[WIFI-7437] Add: support for deployment without TLS for RESTAPI in Helm chart
2026-01-27 10:23:04 +00:00 · 2022-05-06 11:59:52 +03:00
parent bac81ddf69 74dbf8aac0
commit dfd26d3d7f
4 changed files with 74 additions and 7 deletions
--- a/chart/README.md
+++ b/chart/README.md
@@ -189,6 +189,12 @@ All services have 2 REST API endpoints - private and public one. Private endpoin

 You may see example values to enable this feature in [values.restapi-certmanager-certs.yaml](./feature-values/values.restapi-certmanager-certs.yaml).

+### Unsecure REST API endpoints
+
+If you want, you may use configuration property `openwifi.security.restapi.disable=true` in order to disable TLS requirements on REST API endpoints which basically only requires OWGW Websocket TLS certificate in order to deploy the whole environment. If you will pass certificates into the container they will be ignored.
+
+You may see example values to enable this feature in [values.restapi-disable-tls.yaml](./feature-values/values.restapi-disable-tls.yaml).
+
 ## Environment specific values

 This repository contains values files that may be used in the same manner as feature values above to deploy to specific runtime envionemnts (including different cloud deployments).
--- a/chart/environment-values/deploy.sh
+++ b/chart/environment-values/deploy.sh
@@ -38,6 +38,7 @@ usage () {
  echo "- DEVICE_CERT_LOCATION - path to certificate in PEM format that will be used for load simulator";
  echo "- DEVICE_KEY_LOCATION - path to private key in PEM format that will be used for load simulator";
  echo "- USE_SEPARATE_OWGW_LB - flag that should change split external DNS for OWGW and other services"
+  echo "- INTERNAL_RESTAPI_ENDPOINT_SCHEMA - what schema to use for internal RESTAPI endpoints (https by default)"
 }

 # Global variables
@@ -85,6 +86,7 @@ fi

 [ -z ${DEVICE_CERT_LOCATION+x} ] && echo "DEVICE_CERT_LOCATION is unset, setting it to CERT_LOCATION" && export DEVICE_CERT_LOCATION=$CERT_LOCATION
 [ -z ${DEVICE_KEY_LOCATION+x} ] && echo "DEVICE_KEY_LOCATION is unset, setting it to KEY_LOCATION" && export DEVICE_KEY_LOCATION=$KEY_LOCATION
+[ -z ${INTERNAL_RESTAPI_ENDPOINT_SCHEMA+x} ] && echo "INTERNAL_RESTAPI_ENDPOINT_SCHEMA is unset, setting it to 'https'" && export INTERNAL_RESTAPI_ENDPOINT_SCHEMA=https

 # Transform some environment variables
 export OWGW_VERSION_TAG=$(echo ${OWGW_VERSION} | tr '/' '-')
@@ -160,20 +162,20 @@ helm upgrade --install --create-namespace --wait --timeout 60m \
  --set owgw.configProperties."openwifi\.fileuploader\.host\.0\.name"=gw-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owgw.configProperties."rtty\.server"=gw-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owgw.configProperties."openwifi\.system\.uri\.public"=https://gw-${NAMESPACE}.cicd.lab.wlan.tip.build:16002 \
-  --set owgw.configProperties."openwifi\.system\.uri\.private"=https://owgw-owgw:17002 \
+  --set owgw.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owgw-owgw:17002 \
  --set owgw.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owgw.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
  --set owsec.configProperties."authentication\.default\.username"=${OWGW_AUTH_USERNAME} \
  --set owsec.configProperties."authentication\.default\.password"=${OWGW_AUTH_PASSWORD} \
  --set owsec.services.owsec.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=sec-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owsec.configProperties."openwifi\.system\.uri\.public"=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
-  --set owsec.configProperties."openwifi\.system\.uri\.private"=https://owsec-owsec:17001 \
+  --set owsec.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsec-owsec:17001 \
  --set owsec.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owfms.configProperties."s3\.secret"=${OWFMS_S3_SECRET} \
  --set owfms.configProperties."s3\.key"=${OWFMS_S3_KEY} \
  --set owfms.services.owfms.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=fms-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owfms.configProperties."openwifi\.system\.uri\.public"=https://fms-${NAMESPACE}.cicd.lab.wlan.tip.build:16004 \
-  --set owfms.configProperties."openwifi\.system\.uri\.private"=https://owfms-owfms:17004 \
+  --set owfms.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owfms-owfms:17004 \
  --set owfms.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owfms.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
  --set owgwui.ingresses.default.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
@@ -181,7 +183,7 @@ helm upgrade --install --create-namespace --wait --timeout 60m \
  --set owgwui.public_env_variables.DEFAULT_UCENTRALSEC_URL=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
  --set owprov.services.owprov.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=prov-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owprov.configProperties."openwifi\.system\.uri\.public"=https://prov-${NAMESPACE}.cicd.lab.wlan.tip.build:16005 \
-  --set owprov.configProperties."openwifi\.system\.uri\.private"=https://owprov-owprov:17005 \
+  --set owprov.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owprov-owprov:17005 \
  --set owprov.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owprov.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
  --set owprovui.ingresses.default.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=provui-${NAMESPACE}.cicd.lab.wlan.tip.build \
@@ -190,19 +192,19 @@ helm upgrade --install --create-namespace --wait --timeout 60m \
  --set owprovui.public_env_variables.REACT_APP_UCENTRALSEC_URL=https://sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
  --set owanalytics.services.owanalytics.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=analytics-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owanalytics.configProperties."openwifi\.system\.uri\.public"=https://analytics-${NAMESPACE}.cicd.lab.wlan.tip.build:16009 \
-  --set owanalytics.configProperties."openwifi\.system\.uri\.private"=https://owanalytics-owanalytics:17009 \
+  --set owanalytics.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owanalytics-owanalytics:17009 \
  --set owanalytics.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owanalytics.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
  --set owsub.services.owsub.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=sub-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owsub.configProperties."openwifi\.system\.uri\.public"=https://sub-${NAMESPACE}.cicd.lab.wlan.tip.build:16006 \
-  --set owsub.configProperties."openwifi\.system\.uri\.private"=https://owsub-owsub:17006 \
+  --set owsub.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owsub-owsub:17006 \
  --set owsub.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owsub.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
  --set clustersysteminfo.public_env_variables.OWSEC=sec-${NAMESPACE}.cicd.lab.wlan.tip.build:16001 \
  --set clustersysteminfo.secret_env_variables.OWSEC_NEW_PASSWORD=${OWSEC_NEW_PASSWORD} \
  --set owls.services.owls.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=ls-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owls.configProperties."openwifi\.system\.uri\.public"=https://ls-${NAMESPACE}.cicd.lab.wlan.tip.build:16007 \
-  --set owls.configProperties."openwifi\.system\.uri\.private"=https://owls-owls:17007 \
+  --set owls.configProperties."openwifi\.system\.uri\.private"=$INTERNAL_RESTAPI_ENDPOINT_SCHEMA://owls-owls:17007 \
  --set owls.configProperties."openwifi\.system\.uri\.ui"=https://webui-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owlsui.ingresses.default.annotations."external-dns\.alpha\.kubernetes\.io/hostname"=lsui-${NAMESPACE}.cicd.lab.wlan.tip.build \
  --set owlsui.ingresses.default.hosts={lsui-${NAMESPACE}.cicd.lab.wlan.tip.build} \
--- a/chart/environment-values/values.openwifi-qa.disable-tls.yaml
+++ b/chart/environment-values/values.openwifi-qa.disable-tls.yaml
@@ -0,0 +1,29 @@
+# NOTE: using of this values files will require you to use http schema in 'openwifi.system.uri.private' (and maybe 'openwifi.system.uri.public') configuration properties (i.e. http://owgw-owgw:17002)
+owgw:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+
+owsec:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+
+owfms:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+
+owprov:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+
+owanalytics:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+
+owsub:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+
+haproxy:
+  service:
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
--- a/chart/feature-values/values.restapi-disable-tls.yaml
+++ b/chart/feature-values/values.restapi-disable-tls.yaml
@@ -0,0 +1,30 @@
+# NOTE: using of this values files will require you to use http schema in 'openwifi.system.uri.public' configuration properties (i.e. "openwifi.system.uri.public=http://owgw.openwifi.local:16002")
+owgw:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+    openwifi.system.uri.private: http://owsec-owsec:17002
+
+owsec:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+    openwifi.system.uri.private: http://owsec-owsec:17001
+
+owfms:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+    openwifi.system.uri.private: http://owsec-owsec:17004
+
+owprov:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+    openwifi.system.uri.private: http://owsec-owsec:17005
+
+owanalytics:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+    openwifi.system.uri.private: http://owsec-owsec:17009
+
+owsub:
+  configProperties:
+    openwifi.security.restapi.disable: "true"
+    openwifi.system.uri.private: http://owsec-owsec:17006