Merge pull request #230 from dhanendra06/MOSIP-20

MOSIP-43648: cherry-pick the helm changes to release-1.3.x

Author: ckm007

deploy/install.sh

@@ -7,7 +7,7 @@ if [ $# -ge 1 ] ; then
 fi
 
 NS=kernel
-CHART_VERSION=1.3.0-beta.1-develop
+CHART_VERSION=1.3.0-develop
 
 echo Create $NS namespace
 kubectl create ns $NS

helm/auditmanager/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: auditmanager
 description: A Helm chart for MOSIP Auditmanager module
 type: application
-version: 1.3.0-beta.1-develop
+version: 1.3.0-develop
 appVersion: ""
 dependencies:
   - name: common

helm/auditmanager/templates/deployment.yaml

@@ -34,6 +34,7 @@ spec:
       {{- if .Values.hostAliases }}
       hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
       {{- end }}
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds | default 60 }}
       {{- if .Values.affinity }}
       affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.affinity "context" $) | nindent 8 }}
       {{- else }}

helm/auditmanager/values.yaml

@@ -12,18 +12,23 @@
 ##
 commonLabels:
   app.kubernetes.io/component: mosip
+
 ## Add annotations to all the deployed resources
 ##
 commonAnnotations: {}
+
 ## Kubernetes Cluster Domain
 ##
 clusterDomain: cluster.local
+
 ## Extra objects to deploy (value evaluated as a template)
 ##
 extraDeploy: []
+
 ## Number of nodes
 ##
 replicaCount: 1
+
 service:
   type: ClusterIP
   port: 80
@@ -44,10 +49,11 @@ service:
   ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
   ##
   externalTrafficPolicy: Cluster
+
 image:
   registry: docker.io
-  repository: mosipid/kernel-auditmanager-service
-  tag: 1.3.0-beta.1
+  repository: mosipqa/kernel-auditmanager-service
+  tag: 1.3.x
   ## Specify a imagePullPolicy
   ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
   ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
@@ -59,8 +65,10 @@ image:
   ##
   # pullSecrets:
   #   - myRegistryKeySecretName
+
 ## Port on which this particular spring service module is running.
 springServicePort: 8081
+
 ## Configure extra options for liveness and readiness probes
 ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
 ##
@@ -74,6 +82,7 @@ startupProbe:
   timeoutSeconds: 5
   failureThreshold: 30
   successThreshold: 1
+
 livenessProbe:
   enabled: true
   httpGet:
@@ -84,27 +93,31 @@ livenessProbe:
   timeoutSeconds: 5
   failureThreshold: 6
   successThreshold: 1
+
 readinessProbe:
   enabled: true
   httpGet:
     path: /v1/auditmanager/actuator/health
     port: 8081
-  initialDelaySeconds: 0
-  periodSeconds: 10
-  timeoutSeconds: 5
+  initialDelaySeconds: 30
+  periodSeconds: 15
+  timeoutSeconds: 10
   failureThreshold: 6
   successThreshold: 1
+
 ##
 # existingConfigmap:
 
 ## Command and args for running the container (set to default if not set). Use array form
 ##
 command: []
 args: []
+
 ## Deployment pod host aliases
 ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
 ##
 hostAliases: []
+
 ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
 ##
 resources:
@@ -113,36 +126,42 @@ resources:
   # resources, such as Minikube. If you do want to specify resources, uncomment the following
   # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
   limits:
-    cpu: 1000m
-    memory: 2500Mi
+    cpu: 2000m
+    memory: 5000Mi
   requests:
-    cpu: 100m
+    cpu: 300m
     memory: 1500Mi
+
 additionalResources:
   ## Specify any JAVA_OPTS string here. These typically will be specified in conjunction with above resources
   ## Example: java_opts: "-Xms500M -Xmx500M"
-  javaOpts: "-Xms1750M -Xmx1750M"
+  javaOpts: "-Xms3050M -Xmx3050M"
+
 ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
 ## Clamav container already runs as 'mosip' user, so we may not need to enable this
 containerSecurityContext:
   enabled: false
   runAsUser: mosip
   runAsNonRoot: true
+
 ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
 ##
 podSecurityContext:
   enabled: false
   fsGroup: 1001
+
 ## Pod affinity preset
 ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
 ## Allowed values: soft, hard
 ##
 podAffinityPreset: ""
+
 ## Pod anti-affinity preset
 ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
 ## Allowed values: soft, hard
 ##
 podAntiAffinityPreset: soft
+
 ## Node affinity preset
 ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
 ## Allowed values: soft, hard
@@ -164,69 +183,93 @@ nodeAffinityPreset:
   ##   - e2e-az2
   ##
   values: []
+
 ## Affinity for pod assignment. Evaluated as a template.
 ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
 ##
 affinity: {}
+
 ## Node labels for pod assignment. Evaluated as a template.
 ## ref: https://kubernetes.io/docs/user-guide/node-selection/
 ##
 nodeSelector: {}
+
 ## Tolerations for pod assignment. Evaluated as a template.
 ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
 ##
 tolerations: []
+
 ## Pod extra labels
 ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
 ##
 podLabels: {}
+
 ## Annotations for server pods.
 ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
 ##
 podAnnotations: {}
+
 ##  pods' priority.
 ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
 ##
 # priorityClassName: ""
 
 ## lifecycleHooks for the  container to automate configuration before or after startup.
 ##
-lifecycleHooks: {}
+lifecycleHooks:
+  preStop:
+    exec:
+      command:
+        - sh
+        - -c
+        - sleep 30
+
+## Termination grace perios : the maximum amount of time (in seconds) Kubernetes will wait for a container to gracefully shut down
+terminationGracePeriodSeconds: 60
+
 ## Custom Liveness probes for
 ##
 customLivenessProbe: {}
+
 ## Custom Rediness probes
 ##
 customReadinessProbe: {}
+
 ## Update strategy - only really applicable for deployments with RWO PVs attached
 ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the
 ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will
 ## terminate the single previous pod, so that the new, incoming pod can attach to the PV
 ##
 updateStrategy:
   type: RollingUpdate
+
 ## Additional environment variables to set
 ## Example:
 ## extraEnvVars:
 ##   - name: FOO
 ##     value: "bar"
 ##
 extraEnvVars: []
+
 ## ConfigMap with extra environment variables that used
 ##
 extraEnvVarsCM:
   - global
   - config-server-share
   - artifactory-share
+
 ## Secret with extra environment variables
 ##
 extraEnvVarsSecret:
+
 ## Extra volumes to add to the deployment
 ##
 extraVolumes: []
+
 ## Extra volume mounts to add to the container
 ##
 extraVolumeMounts: []
+
 ## Add init containers to the  pods.
 ## Example:
 ## initContainers:
@@ -241,7 +284,17 @@ initContainers:
   - command:
       - /bin/bash
       - -c
-      - if [ "$ENABLE_INSECURE" = "true" ]; then HOST=$( env | grep "mosip-api-internal-host" |sed "s/mosip-api-internal-host=//g"); if [ -z "$HOST" ]; then echo "HOST $HOST is empty; EXITING"; exit 1; fi; openssl s_client -servername "$HOST" -connect "$HOST":443  > "$HOST.cer" 2>/dev/null & sleep 2 ; sed -i -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' "$HOST.cer"; cat "$HOST.cer"; /usr/local/openjdk-11/bin/keytool -delete -alias "$HOST" -keystore $JAVA_HOME/lib/security/cacerts  -storepass changeit; /usr/local/openjdk-11/bin/keytool -trustcacerts -keystore "$JAVA_HOME/lib/security/cacerts" -storepass changeit -noprompt -importcert -alias "$HOST" -file "$HOST.cer" ; if [ $? -gt 0 ]; then echo "Failed to add SSL certificate for host $host; EXITING"; exit 1; fi; cp /usr/local/openjdk-11/lib/security/cacerts /cacerts; fi
+      - if [ "$ENABLE_INSECURE" = "true" ]; then HOST=$( env | grep "mosip-api-internal-host"
+        |sed "s/mosip-api-internal-host=//g"); if [ -z "$HOST" ]; then echo "HOST
+        $HOST is empty; EXITING"; exit 1; fi; openssl s_client -servername "$HOST"
+        -connect "$HOST":443  > "$HOST.cer" 2>/dev/null & sleep 2 ; sed -i -ne '/-BEGIN
+        CERTIFICATE-/,/-END CERTIFICATE-/p' "$HOST.cer"; cat "$HOST.cer"; /usr/local/openjdk-11/bin/keytool
+        -delete -alias "$HOST" -keystore $JAVA_HOME/lib/security/cacerts  -storepass
+        changeit; /usr/local/openjdk-11/bin/keytool -trustcacerts -keystore "$JAVA_HOME/lib/security/cacerts"
+        -storepass changeit -noprompt -importcert -alias "$HOST" -file "$HOST.cer"
+        ; if [ $? -gt 0 ]; then echo "Failed to add SSL certificate for host $host;
+        EXITING"; exit 1; fi; cp /usr/local/openjdk-11/lib/security/cacerts /cacerts;
+        fi
     env:
       - name: ENABLE_INSECURE
         value: "true"
@@ -259,6 +312,7 @@ initContainers:
     volumeMounts:
       - mountPath: /cacerts
         name: cacerts
+
 ## Add sidecars to the  pods.
 ## Example:
 ## sidecars:
@@ -270,6 +324,7 @@ initContainers:
 ##         containerPort: 1234
 ##
 sidecars: {}
+
 persistence:
   enabled: false
   ## If defined, storageClassName: <storageClass>
@@ -291,15 +346,16 @@ persistence:
   existingClaim:
   # Dir where config and keys are written inside container
   mountDir:
+
 ## Init containers parameters:
 ## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section.
 ##
 volumePermissions:
   enabled: false
   image:
     registry: docker.io
-    repository: bitnami/bitnami-shell
-    tag: "10"
+    repository: mosipid/os-shell
+    tag: "12-debian-12-r46"
     pullPolicy: Always
     ## Optionally specify an array of imagePullSecrets.
     ## Secrets must be manually created in the namespace.
@@ -324,10 +380,12 @@ volumePermissions:
     ##   cpu: 100m
     ##   memory: 128Mi
     ##
+
 ## Specifies whether RBAC resources should be created
 ##
 rbac:
   create: true
+
 ## Specifies whether a ServiceAccount should be created
 ##
 serviceAccount:
@@ -336,6 +394,7 @@ serviceAccount:
   ## If not set and create is true, a name is generated using the fullname template
   ##
   name:
+
 ## Prometheus Metrics
 ##
 metrics:
@@ -345,7 +404,9 @@ metrics:
   ##
   podAnnotations:
     prometheus.io/scrape: "true"
+
   endpointPath: /v1/auditmanager/actuator/prometheus
+
   ## Prometheus Service Monitor
   ## ref: https://github.com/coreos/prometheus-operator
   ##
@@ -372,6 +433,7 @@ metrics:
     ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec
     ##
     additionalLabels: {}
+
   ## Custom PrometheusRule to be defined
   ## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart
   ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions
@@ -389,9 +451,11 @@ metrics:
     #     labels:
     #       severity: error
     rules: []
+
 ## Only internal access
 istio:
   enabled: true
   gateway: istio-system/internal
   prefix: /v1/auditmanager
+
 enable_insecure: false