Add esignet-standalone-2.0.0 profile (Go eSignet) support - #311
Open
bhumi46 wants to merge 94 commits into
Open
Conversation
Isolate signup-captcha secret/env-var for esignet-standalone-2.0.0 (same collision class as the earlier esignet-captcha fix, but live), and revert an over-eager rename of mosip_signup_client_secret since both profiles share the same hardcoded Keycloak client. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
feat(helmsman): add isolated esignet-standalone-2.0.0 profile
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
fix(helmsman): postgres-init-esignet su.secret nil pointer + postgres-init-signup default
Copy keycloak-host/keycloak-env-vars/keycloak/keycloak-client-secrets into the esignet-standalone-2.0.0 namespace, since the shared external-dsf.yaml fan-out hook only targets the original esignet-standalone namespaces. Onboarder apps in this namespace reference these directly. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Fix chart-auto-generated *-share configmap name mismatches (release-name-derived, not part of the original rename token vocabulary), and duplicate the 6 shared utils values files that hardcoded old secret names (esignet-captcha, esignet-softhsm*, softhsm-mock-identity-system) into a new Helmsman/utils/esignet-standalone-2.0.0/ directory, repointing esignet-dsf.yaml at the isolated copies. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
fix(helmsman): copy keycloak resources into esignet-standalone-2.0.0 namespaces
Revert mock-smtp public hostname back to shared smtp.${domain_name} for esignet-standalone-2.0.0, since smtp-2-0-0 was intentionally not added to the terraform DNS subdomain list. Internal cluster-DNS references (mock-smtp-2-0-0.mock-smtp-2-0-0) are unaffected, as they resolve via CoreDNS regardless of any Route53 record.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
fix(helmsman): revert esignet-standalone-2.0.0 mock-smtp hostname to shared smtp
Rename esignet-mock/mosipid1/mosipid2/sunbird namespaces, Helm release names, and hostnames to esignet-go-* within the esignet-standalone-2.0.0 profile only, dropping the -2-0-0 suffix on every identifier touched. Also renames the base SoftHSM release and captcha secrets/env-vars (esignet-softhsm-2-0-0 -> esignet-softhsm-go, esignet-captcha-2-0-0 -> esignet-captcha-go, softhsm-mock-identity-system-2-0-0 -> softhsm-mock-identity-system-go, plus mosipid1/mosipid2/sunbird equivalents) for consistency with the new naming scheme, and fixes a latent bug where captcha-postinstall.sh created the base captcha secret with suffixed key names that didn't match what the values files expected. Restructures helmsman_esignet.yml's softhsm-upgrade-skip release:namespace pairs from a single suffix variable into an explicit per-profile list, since the 2.0.0 profile's release and namespace names no longer share one common suffix pattern. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Complete the -go rename across the rest of the esignet-standalone-2.0.0 profile: signup-captcha, and every remaining -2-0-0-suffixed namespace, release name, hostname, and Postgres database/user name (signup, kernel services, mock-relying-party base instances, mock-smtp, config-server, mock-identity-system, oidc-ui, softhsm, apitestrig releases, MISP/mock-RP onboarders, and the isolated postgres-init database entries in the shared external-dsf.yaml). Original esignet-standalone profile and its unsuffixed database entries are untouched. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <bhumi46@users.noreply.github.com>
fix: rename esignet-mock/mosipid1/mosipid2/sunbird to esignet-go-* in esignet-standalone-2.0.0 (mosip#302)
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Fix broken YAML in esignet-plugin-values-2-0-0.yaml: a block of extraEnvVars entries appended by the chart-versions update used 2-space list indentation while the rest of the file's extraEnvVars sequence uses 1-space indentation, causing "did not find expected '-' indicator" on deploy. Re-indented to match. Also removes the OIDC_UI_HOSTNAME entry (sourced from the esignet-global configmap) from the base, mosipid1, and mosipid2 plugin-values files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…mosipid instance Updates 7 docs/*.md files that still described the retired two-instance architecture (separate mosipid1/mosipid2 namespaces, the enable_mosipid2 toggle, split MOSIPID1_*/MOSIPID2_* secrets and variables). Several sections needed real restructuring rather than renaming — e.g. the deployment guide's "When do you need mosipid1?" / "When do you need mosipid2?" subsections collapse into one, since mosipid is now always deployed with no toggle, and its "up to 4 instances" framing becomes 3. Also corrects now-stale "-go" references intermixed in the same sentences/tables (separate -go-suffixed namespaces/hostnames, a two-column esignet-standalone vs esignet-standalone-2.0.0 URL table) left over from the earlier, separately-completed -go removal work — both profiles use identical namespaces/hostnames now, so most of these collapse to a single description instead of two parallel ones. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ne profiles esignet-config-server, pms-partner-mosipid, and pms-policy-mosipid were already enabled: false in both esignet-standalone and esignet-standalone-2.0.0's esignet-dsf.yaml. Removes the app blocks entirely along with their dedicated hook scripts and values files, rather than leaving disabled dead weight in the DSFs. Also removes the now-dangling partnermanager=pms-mosipid.*/ policymanager=pms-mosipid.* entries from testrigs-dsf.yaml's mosip_components_base_urls (in both profiles), which would otherwise point the apitestrig at a service that no longer exists. Left untouched: the shared external-dsf.yaml's mosip_pms_client_secret Keycloak client-secret provisioning and the PMS_CLIENT_SECRET_KEY/VALUE fetch step in helmsman_esignet.yml — harmless if unused, and removing them would mean re-indexing a 5-entry array shared across profiles, a separate change from this app removal. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…net-standalone-2.0.0)
esignet-mock now uses KEYMANAGER_KEYSTORE_TYPE=PKCS12 instead of SoftHSM/
PKCS11, with a PVC (persistence.enabled, chart-managed) mounted at the
chart's default /home/mosip/config/ so the keystore file survives pod
restarts. The app generates the PKCS12 keystore itself on first run
when it doesn't already exist at KEYMANAGER_PKCS12_FILE_PATH — no init
container or preinstall hook needed.
Uses a fixed known password ("localtest"), matching the precedent this
repo already established for the same throwaway/self-signed keystore
use case (mosipid1's now-removed PKCS12 setup) — esignet-mock is a mock/
demo instance, not production key material.
esignet-mosipid and esignet-sunbird are untouched and remain on PKCS11/
SoftHSM.
Verified via `helm template` against the local esignet chart checkout
(PVC created, env vars wired to the right mount) and `helmsman -dry-run
-debug` against the DSF (19 apps, correct per-instance keystore values).
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…onal extraEnvVars is merged with the chart's own default extraEnvVars map before rendering, so removing the previous explicit PKCS11 overrides just let the chart's PKCS11 defaults resurface for the same keys instead of disappearing. extraEnvVarsAdditional renders after extraEnvVars in the container's env: list, so with Kubernetes' last-wins behavior for duplicate env var names, setting KEYMANAGER_KEYSTORE_TYPE/KEYMANAGER_PKCS12_FILE_PATH/ KEYMANAGER_PKCS12_PASSWORD there correctly overrides the chart's PKCS11 defaults instead of merely coexisting with them. Verified via `helm template` against the local esignet chart checkout: both a PKCS11 (chart default, from extraEnvVars) and PKCS12 (from extraEnvVarsAdditional) KEYMANAGER_KEYSTORE_TYPE entry appear in the rendered container env list, in that order, with PKCS12 taking effect. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…sAdditional Relocates KEYMANAGER_DB_SCHEMA/KEYMANAGER_KEYSTORE_TYPE/KEYMANAGER_PKCS11_* from extraEnvVars to extraEnvVarsAdditional for both instances, using the generic chart-default values (pkcs11-proxy module path/token label, shared esignet-softhsm secret name) as specified, replacing the previous per-instance values (real softhsm module path, "esignet" token label, esignet-softhsm-mosipid/esignet-softhsm-sunbird secrets). Verified via `helmsman -dry-run -debug`: 19 apps, both instances' resolved values match exactly. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…sunbird Keeps the generic pkcs11-proxy module path/token label, but the PIN secret must be the instance-specific one (esignet-softhsm-mosipid, esignet-softhsm-sunbird) since that's where each instance's actual SoftHSM PIN lives - a shared esignet-softhsm secret doesn't exist in those namespaces. Verified via helmsman -dry-run -debug: 19 apps, both instances resolve to their correct per-instance secret name. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
mosip/captcha's chart default extraEnvVars only contains
MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_PREREGISTRATION, sourced from a
mosip-captcha/prereg-captcha-secret-key secret that doesn't exist in
this deployment (no preregistration module in the esignet-standalone
profiles), causing a config error on the captcha pod. Sets
extraEnvVars: "" to empty it out — the chart's extraEnvVars is a raw
YAML block string (common.tplvalues.render'd, not a list or map like
other charts in this repo), so an empty string is what skips the
{{- if .Values.extraEnvVars }} block entirely.
esignet/mosipid/sunbird/signup captcha secrets are unaffected — those
are wired up separately via kubectl patch in the *-preinstall.sh /
captcha-postinstall.sh hooks, not through this chart value.
Verified via `helm template` against the actual mosip/captcha v0.1.1
chart (env var gone, everything else byte-identical) and
`helmsman -dry-run -debug` against external-dsf.yaml.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…nbird KEYMANAGER_PKCS11_TOKEN_LABEL corrected from pkcs11-proxy to mosip-token for esignet-mosipid and esignet-sunbird. Adds hsm_client_zip_url_env, a plain container env var (not a chart value) read directly by esignet-service's docker-entrypoint.sh at startup - if set, it downloads and unzips a PKCS11 client library from the given URL into hsm_local_dir_env before the app starts. The esignet-service Dockerfile only bakes this in via a build-arg with no default, so without setting it at runtime the KEYMANAGER_PKCS11_MODULE_PATH (/usr/local/lib/softhsm/libpkcs11-proxy.so) referenced by these two instances may not actually exist in the container. Note: hsm_local_dir_env defaults to a relative "hsm-client" dir (under work_dir, i.e. /home/mosip/hsm-client) per the Dockerfile, not /usr/local/lib/softhsm - not touched here since it wasn't part of what was asked, but worth checking that the downloaded zip's contents actually land at the configured module path. Verified via helmsman -dry-run -debug: 19 apps, both instances resolve to the correct values. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
extraEnvVarsCM[1]: "esignet-global" removed from esignet-mosipid's set block. extraEnvVarsCM[0] (esignet-softhsm-mosipid-share) is untouched. Verified via helmsman -dry-run -debug: 19 apps, esignet-mosipid's extraEnvVarsCM resolves to just the softhsm-share entry. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…et-mosipid
Root cause (verified against Helmsman v3.17.1 source,
internal/app/release.go getSetValues()): Helmsman unconditionally
escapes every literal comma in every set: value via
strings.ReplaceAll(v, ",", "\\,") before passing it to `helm --set`,
regardless of whether the value already contains a manually-escaped
\, sequence. Values in this file that were hand-escaped per Helm's own
strvals convention (\, for a literal comma) got double-escaped into
\\, by Helmsman, which strvals then parses as "literal backslash
followed by an unescaped separator comma" - splitting the value
mid-string and producing dangling tokens like the "phone" segment of
MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS's postfix values.
Fix: remove the manual \, escaping (plain commas), since Helmsman
already adds it automatically. \{ and \} escaping is untouched -
Helmsman's ReplaceAll only touches commas.
None of this was caught by this session's earlier helmsman -dry-run
verifications because dry-run against a fake/unreachable kubeconfig
fails at namespace creation, before Helmsman ever reaches the
getSetValues() call that happens right before invoking `helm upgrade
--install`.
Verified by replicating Helmsman's exact getSetValues() transform
(one --set flag per key, ReplaceAll(",", "\\,") per value) against
the real esignet-mock/esignet-mosipid/esignet-sunbird set: blocks with
a local helm template call: reproduced the exact "key \"phone\" has no
value" failure before the fix, confirmed clean parsing with the
correct final values (e.g. LOGIN_ID_OPTIONS renders its Handlebars
wrapper and postfix values intact, IDA_OTP_CHANNELS renders as
"email,phone") after it. Also re-ran helmsman -dry-run -debug: 19 apps
parse correctly.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…nbird Root cause: the mosip/esignet chart's own default extraEnvVars entries reference cluster resources that don't exist in every namespace this profile deploys into, and Kubernetes fails the whole pod if any single env entry references a missing ConfigMap/Secret key - even when a working duplicate (added via our own extraEnvVars/extraEnvVarsAdditional overrides) exists elsewhere in the same env: list. esignet-mock: MOSIP_API_INTERNAL_HOST, MOSIP_ESIGNET_OIDC_UI_HOSTNAME, MOSIP_ESIGNET_HOST, MOSIP_SIGNUP_HOST default to configMapKeyRefs against an "esignet-global" configmap that only exists for the mosipid/sunbird instances (created by their own preinstall hooks) - esignet-mock's hook never creates one. Overridden to plain hostname strings matching domainConfig's already-correct values. esignet-mosipid/esignet-sunbird: KEYMANAGER_PKCS11_PIN defaults to a secretKeyRef against a plain "esignet-softhsm" secret that only exists in the mock namespace. Each instance already had this correctly overridden under extraEnvVarsAdditional, but that doesn't remove the broken chart-default entry under extraEnvVars - both instances now also override it directly under extraEnvVars, pointing at their own esignet-softhsm-mosipid/esignet-softhsm-sunbird secret. Verified via helmsman -dry-run -debug: 19 apps, all three instances' resolved values are correct and consistent with their domainConfig/ extraEnvVarsAdditional counterparts. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Set via extraEnvVarsAdditional alongside the other PKCS12 keymanager overrides for this instance, consistent with the existing convention (renders after extraEnvVars, so it reliably takes effect regardless of chart defaults for the same key). Verified via helmsman -dry-run -debug: 19 apps, value resolves correctly for esignet-mock only. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Keeps persistence.mountDir at the chart default (/home/mosip/config/) rather than /home/mosip - the latter is the container's WORKDIR where entrypoint.sh, esignet.exe, and data/ are baked in per the Dockerfile (ENTRYPOINT ["/home/mosip/entrypoint.sh"], CMD ["/home/mosip/esignet.exe"]), so mounting the PVC there would hide them and likely crash the container on start. The file still lands on the persistent volume, just renamed from esignet.pfx to keystore.p12. Verified via helmsman -dry-run -debug: 19 apps, value resolves correctly. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY (hyphen) never matched the real MOSIP_ESIGNET_CAPTCHA_SITE_KEY env var read by the chart, so the captcha site key was silently unset for esignet-mosipid. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…/sunbird Chart-default extraEnvVars.KEYMANAGER_KEYSTORE_TYPE/PKCS11_MODULE_PATH/ PKCS11_TOKEN_LABEL/PKCS11_SLOT_ID/PKCS11_PIN/DB_SCHEMA were being overridden only via extraEnvVarsAdditional, which relies on rendering order to win rather than replacing the chart-default extraEnvVars entries. That left redundant/confusing duplicate env entries in the rendered manifest for all three esignet-standalone-2.0.0 instances. Override these keys directly under extraEnvVars instead so only one entry per key renders. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
The MINIO_ROOT_PASSWORD fetch in helmsman_external.yml ran before WireGuard/kubeconfig were set up, so kubectl could never reach the cluster and the value was always empty. Moved the fetch to its own step after cluster access is verified, and wired auth.rootPassword into the minio app's set: block in external-dsf.yaml so the fetched password actually reaches helm upgrade (previously it was fetched but never consumed by the minio release itself). Signed-off-by: bhumi46 <thisisbn46@gmail.com>
… databases Previously these three namespaces silently shared their Postgres database with the retired v1.7.1 esignet-standalone profile (mosip_esignet / mosip_esignet_sunbird / mosip_esignet_mosipid, branch develop) despite comments claiming isolation. Enable the existing but unused/orphaned mosip_esignet_go / mosip_esignet_go_sunbird / mosip_esignet_go_mosipid entries, set their branch to develop-go, and repoint the three esignet-standalone-2.0.0 preinstall hooks' postgres-config patches at these dedicated db names/users so the isolation is actually real. Note: this starts these three namespaces on fresh, empty databases - no data carries over from the previously shared ones. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Changed image.repository from mosipqa/esignet to mosipdev/esignet for esignet-mock, esignet-mosipid, and esignet-sunbird (tag stays develop-go). Also removed the redundant extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID override for mosipid/sunbird - it duplicated the chart's own default (0), which already renders correctly without an explicit override. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…osipid/sunbird extraEnvVars.AUTHN_PROVIDER wasn't the env var the chart/app actually reads (chart default key is MOSIP_ESIGNET_AUTHN_PROVIDER: mosip) - our override under the wrong name never took effect, so all three instances silently ran with the chart default 'mosip' regardless of what we set. Renamed to MOSIP_ESIGNET_AUTHN_PROVIDER with correct per-instance values (mock/mosip/ sunbird), and added NAMESPACE (mock/mosipid/sunbird respectively) which previously only existed for mosipid, and only via extraEnvVarsAdditional. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
… esignet-mock/mosipid/sunbird Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…_HOST env entries Both domainConfig and the chart's own extraEnvVars defaults set these same three key names, rendering as two separate entries with the same 'name' in the container's env: list. Kubernetes' strategic-merge-patch can't compute a consistent $setElementOrder when the merge key isn't unique, causing 'Diffing release... failed' errors on upgrade for esignet-mosipid and esignet-sunbird. esignet-mock already had correct extraEnvVars overrides for these keys (needed separately to avoid a missing esignet-global configmap crash) - just removed the redundant domainConfig copies there. esignet-mosipid/esignet-sunbird only had domainConfig entries; moved them into extraEnvVars unchanged. This also matters for correctness, not just dedup: the chart-default extraEnvVars values (sourced from the esignet-global configmap) are missing the https:// scheme, and for mosipid specifically point at the wrong domain (domain_name instead of mosipid_domain_name) - letting the chart default become the sole source would have silently broken the mosip-identity-plugin's actual endpoints. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Was set under both extraEnvVars and extraEnvVarsAdditional with identical values, rendering as two same-named entries in the env: list - same duplicate-key class as the recent MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/ MOSIP_API_INTERNAL_HOST fix, confirmed via the live deployed pod spec. Kept the extraEnvVars entry, removed the redundant extraEnvVarsAdditional copy. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…or esignet-mock Same duplicate-key class as the recent env var fixes - set under both extraEnvVars and extraEnvVarsAdditional with identical values. Kept the extraEnvVars entry, removed the redundant extraEnvVarsAdditional copy. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…_INTERNAL_HOST instead of string-overriding for mosipid/sunbird The previous fix overrode these chart-default extraEnvVars entries (tables, via valueFrom.configMapKeyRef) with plain string values at the same key. That still eliminated the duplicate-name issue, but Helm's coalesce logic emits a 'cannot overwrite table with non table' warning for every such override - confirmed via a real Helm 3.17.1 binary (matching what CI installs) that this warning is harmless on its own (the override still applies correctly), but it's very likely eating into Helmsman's truncated error output and masking whatever the actual 'Diffing release... failed with exit code 2' error is for esignet-mosipid/esignet-sunbird (esignet-mock has the same warning pattern today without failing, ruling out the warning itself as the cause). Switched to nulling the chart-default keys entirely (null, quoted - a bare YAML null unmarshals to an empty string via Helmsman's sigs.k8s.io/yaml parsing, not the literal text Helm needs) and moved the actual values back to domainConfig, which no longer conflicts since extraEnvVars no longer supplies these keys at all. Verified against a real Helm 3.17.1 binary: zero warnings, single correct entry per key. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…IP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST/MOSIP_ESIGNET_OIDC_UI_HOSTNAME/KEYMANAGER_PKCS11_PIN Same fix as the recent mosipid/sunbird change, applied to mock for consistency. These five chart-default extraEnvVars entries are all tables (valueFrom.configMapKeyRef or secretKeyRef), and mock's plain-value overrides at the same keys triggered 'cannot overwrite table with non table' coalesce warnings - confirmed harmless on their own via a real Helm 3.17.1 binary, but still worth removing since verbose warnings risk masking real errors in Helmsman's truncated CI output. MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST: nulled under extraEnvVars, values moved to domainConfig (safe for mock specifically - no esignet-global configmap reference survives since the chart-default key is fully deleted, not just given a literal value). MOSIP_ESIGNET_OIDC_UI_HOSTNAME: nulled under extraEnvVars, value moved to extraEnvVarsAdditional (no domainConfig equivalent key exists for this one). KEYMANAGER_PKCS11_PIN: changed from an empty-string override to null - same functional result (PKCS11 unused, PKCS12 is the active keystore type) but as a real deletion instead of a type-conflicting empty string. Verified against a real Helm 3.17.1 binary with mock's full 90-key --set list: exit 0, zero warnings, single correct entry per key. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Same class of bug as the recent esignet-mock/mosipid/sunbird fixes, found while auditing mock-identity-system, mock-relying-party-service/-ui, and oidc-ui for similar issues. domainConfig.MOSIP_ESIGNET_HOST was set, but the chart-default extraEnvVars.MOSIP_ESIGNET_HOST (a table referencing the esignet-global configmap, which doesn't exist in the esignet-mock namespace) was never nulled - producing both a duplicate-named env entry and a CreateContainerConfigError crash risk. Verified via helm template: single entry, correct value, zero warnings. mock-relying-party-service/-ui and oidc-ui were also audited - their chart defaults for extraEnvVars/domainConfig are empty or unused by this DSF, so no equivalent issue exists there. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Previously left unset (chart default '0' rendered implicitly). Now explicitly deleted so it doesn't render at all, matching the pattern used for the other KEYMANAGER_* keys. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
The esignet-misp-onboarder-key secret only ever holds an empty value, since the onboarder app that would populate it with a real MISP license key is disabled (and has unrelated ordering/namespace-targeting issues of its own). An empty MISP key makes the Go esignet service Fatal on startup during plugin provider init, blocking esignet-mosipid entirely. Set a literal placeholder value directly instead, to be replaced with the real MISP license key once available. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
The secretKeyRef wiring itself is correct and was already there. The reason it wasn't reflecting on the live esignet-mosipid pod is almost certainly the value/valueFrom merge-patch conflict from before (commit acf6b09) blocking upgrades entirely for that release, not a problem with this specific config. Once the live Deployment is deleted and recreated (as discussed), it should pick up correctly. The secret's value itself is still empty pending either the onboarder being properly wired for mosipid or a real MISP license key being supplied. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the
esignet-standalone-2.0.0profile (Go-based eSignet instances) fromes-go-testintodevelop, including:Helmsman/dsf/esignet-standalone-2.0.0/DSF files andHelmsman/utils/esignet-standalone-2.0.0/values files for the Go eSignet, OIDC UI, mock-relying-party, and config-server deployments (-go-suffixed namespaces/hostnames, coexisting with the existing v1.7.1esignet-standaloneprofile on shared external infrastructure)esignet-standalone-2.0.0profile option added tohelmsman_esignet.yml,helmsman_testrigs.yml, andhelmsman_signup.ymlesignet-standaloneclusterdocs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md) updated withesignet-standalone-2.0.0instructions alongside the existingesignet-standaloneguideRelated: #2288
Test plan
helmsman -f Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml --applydry-run validates cleanlyesignet-standalone-2.0.0profile end to end alongsideesignet-standaloneand confirm no namespace/hostname/captcha collisionsesignet-standaloneprofile applies without drift🤖 Generated with Claude Code
Summary by CodeRabbit