From 05d12c24e69d91d99d877440ab3b5cd94158920c Mon Sep 17 00:00:00 2001 From: lpapadopoulos Date: Tue, 14 Jul 2026 17:18:47 +0300 Subject: [PATCH 1/7] feat: peering vault sidecar --- .../config/vault-agent-peering-api-cm.yaml | 30 +++++++++++++++++++ .../templates/peering-api/deployment.yaml | 27 ++++++++++++++--- charts/hypo/templates/peering-api/sa.yaml | 8 +++++ charts/hypo/templates/vault/job.yaml | 17 +++++++++-- 4 files changed, 76 insertions(+), 6 deletions(-) create mode 100644 charts/hypo/templates/config/vault-agent-peering-api-cm.yaml create mode 100644 charts/hypo/templates/peering-api/sa.yaml diff --git a/charts/hypo/templates/config/vault-agent-peering-api-cm.yaml b/charts/hypo/templates/config/vault-agent-peering-api-cm.yaml new file mode 100644 index 0000000..b557620 --- /dev/null +++ b/charts/hypo/templates/config/vault-agent-peering-api-cm.yaml @@ -0,0 +1,30 @@ +{{ $vaultServer := index .Values "vault-server" }} + {{ $peeringApi := index .Values "peering-api" }} + {{- if and $peeringApi.enabled $vaultServer.enabled -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: vault-agent-peering-api-config + namespace: {{ .Release.Namespace }} +data: + agent-config.hcl: | + vault { + address = "http://{{ template "hypo.vault-server.url" . }}:{{ $vaultServer.service.port }}" + } + + auto_auth { + method "kubernetes" { + mount_path = "auth/kubernetes" + config = { + role = "peering-api" + } + } + + sink "file" { + config = { + path = "/vault/secrets/token" + mode = 0644 + } + } + } + {{- end -}} diff --git a/charts/hypo/templates/peering-api/deployment.yaml b/charts/hypo/templates/peering-api/deployment.yaml index a24e6ed..9b9797a 100644 --- a/charts/hypo/templates/peering-api/deployment.yaml +++ b/charts/hypo/templates/peering-api/deployment.yaml @@ -1,4 +1,5 @@ {{ $peeringApi := index .Values "peering-api" }} +{{ $vaultServer := index .Values "vault-server" }} {{ $postgresqlDb := index .Values "postgresql-db" }} {{- if $peeringApi.enabled -}} apiVersion: apps/v1 @@ -28,6 +29,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: + serviceAccountName: peering-api initContainers: - name: wait-for-postgres image: busybox:latest @@ -79,20 +81,37 @@ spec: value: {{ template "hypo.kafka.url" . }}:{{ .Values.kafka.service.ports.client }} - name: _PROD_QUARKUS_DATASOURCE_JDBC_URL value: jdbc:postgresql://{{ template "hypo.postgresql.url" . }}:{{ include "hypo.postgresql.port" . }}/PEERING_DB - - name: _PROD_QUARKUS_DATASOURCE_USERNAME + - name: _PROD_QUARKUS_DATASOURCE_USERNAME value: {{ $postgresqlDb.auth.username }} - - name: _PROD_QUARKUS_DATASOURCE_PASSWORD + - name: _PROD_QUARKUS_DATASOURCE_PASSWORD value: {{ $postgresqlDb.auth.password }} - name: _PROD_QUARKUS_OTEL_EXPORTER_OTLP_TRACES_ENDPOINT value: http://{{ template "hypo.otel.url" . }}:{{ include "hypo.otel.port" . }} resources: {{- toYaml $peeringApi.resources | nindent 12 }} - {{- with $peeringApi.volumeMounts }} volumeMounts: + - name: vault-secrets + mountPath: /vault/secrets + { { - with $peeringApi.volumeMounts } } {{- toYaml . | nindent 12 }} {{- end }} - {{- with $peeringApi.volumes }} + - name: vault-agent + image: "{{ $vaultServer.image.repository }}:{{ $vaultServer.image.tag }}" + imagePullPolicy: { { $vaultServer.image.pullPolicy } } + args: [ "agent", "-config=/vault/config/agent-config.hcl" ] + volumeMounts: + - name: vault-agent-peering-api-config + mountPath: /vault/config + - name: vault-secrets + mountPath: /vault/secrets volumes: + - name: vault-secrets + emptyDir: + medium: Memory + - name: vault-agent-peering-api-config + configMap: + name: vault-agent-peering-api-config + { { - with $peeringApi.volumes } } {{- toYaml . | nindent 8 }} {{- end }} {{- end -}} diff --git a/charts/hypo/templates/peering-api/sa.yaml b/charts/hypo/templates/peering-api/sa.yaml new file mode 100644 index 0000000..a3d6d3e --- /dev/null +++ b/charts/hypo/templates/peering-api/sa.yaml @@ -0,0 +1,8 @@ +{{ $peeringApi := index .Values "peering-api" }} + {{- if $peeringApi.enabled -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: peering-api + namespace: {{ .Release.Namespace }} + {{- end -}} diff --git a/charts/hypo/templates/vault/job.yaml b/charts/hypo/templates/vault/job.yaml index 09943d5..5e3e753 100644 --- a/charts/hypo/templates/vault/job.yaml +++ b/charts/hypo/templates/vault/job.yaml @@ -25,7 +25,7 @@ spec: fieldRef: fieldPath: status.hostIP args: [ 'sh', '-c', 'until nc -z -w 1 $NODE_IP {{ .Values.keycloak.service.nodePorts.http }}; do echo "Sleeping for Keycloak"; sleep 1; done; echo "ready!";' ] - {{- end }} + {{- end }} containers: - name: vault-unseal image: "{{ $vaultServer.image.repository }}:{{ $vaultServer.image.tag }}" @@ -128,6 +128,19 @@ spec: policies="hypo-fabric-policy" \ ttl=1h + cat > hypo-peering-policy.hcl < Date: Wed, 15 Jul 2026 11:15:53 +0300 Subject: [PATCH 2/7] feat: peering vault sidecar --- charts/hypo/templates/peering-api/deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/hypo/templates/peering-api/deployment.yaml b/charts/hypo/templates/peering-api/deployment.yaml index 9b9797a..483a8e3 100644 --- a/charts/hypo/templates/peering-api/deployment.yaml +++ b/charts/hypo/templates/peering-api/deployment.yaml @@ -92,7 +92,7 @@ spec: volumeMounts: - name: vault-secrets mountPath: /vault/secrets - { { - with $peeringApi.volumeMounts } } + {{- with $peeringApi.volumeMounts }} {{- toYaml . | nindent 12 }} {{- end }} - name: vault-agent @@ -111,7 +111,7 @@ spec: - name: vault-agent-peering-api-config configMap: name: vault-agent-peering-api-config - { { - with $peeringApi.volumes } } + {{- with $peeringApi.volumes }} {{- toYaml . | nindent 8 }} {{- end }} {{- end -}} -- GitLab From 59342454d974a7c17438491204396c5d8c5c5d73 Mon Sep 17 00:00:00 2001 From: lpapadopoulos Date: Wed, 15 Jul 2026 11:32:15 +0300 Subject: [PATCH 3/7] feat: peering vault sidecar --- charts/hypo/templates/config/vault-agent-peering-api-cm.yaml | 4 ++-- charts/hypo/templates/peering-api/deployment.yaml | 2 +- charts/hypo/templates/peering-api/sa.yaml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/hypo/templates/config/vault-agent-peering-api-cm.yaml b/charts/hypo/templates/config/vault-agent-peering-api-cm.yaml index b557620..48d013e 100644 --- a/charts/hypo/templates/config/vault-agent-peering-api-cm.yaml +++ b/charts/hypo/templates/config/vault-agent-peering-api-cm.yaml @@ -1,6 +1,6 @@ {{ $vaultServer := index .Values "vault-server" }} - {{ $peeringApi := index .Values "peering-api" }} - {{- if and $peeringApi.enabled $vaultServer.enabled -}} +{{ $peeringApi := index .Values "peering-api" }} +{{- if and $peeringApi.enabled $vaultServer.enabled -}} apiVersion: v1 kind: ConfigMap metadata: diff --git a/charts/hypo/templates/peering-api/deployment.yaml b/charts/hypo/templates/peering-api/deployment.yaml index 483a8e3..f968d94 100644 --- a/charts/hypo/templates/peering-api/deployment.yaml +++ b/charts/hypo/templates/peering-api/deployment.yaml @@ -97,7 +97,7 @@ spec: {{- end }} - name: vault-agent image: "{{ $vaultServer.image.repository }}:{{ $vaultServer.image.tag }}" - imagePullPolicy: { { $vaultServer.image.pullPolicy } } + imagePullPolicy: {{ $vaultServer.image.pullPolicy }} args: [ "agent", "-config=/vault/config/agent-config.hcl" ] volumeMounts: - name: vault-agent-peering-api-config diff --git a/charts/hypo/templates/peering-api/sa.yaml b/charts/hypo/templates/peering-api/sa.yaml index a3d6d3e..952d63b 100644 --- a/charts/hypo/templates/peering-api/sa.yaml +++ b/charts/hypo/templates/peering-api/sa.yaml @@ -1,5 +1,5 @@ {{ $peeringApi := index .Values "peering-api" }} - {{- if $peeringApi.enabled -}} +{{- if $peeringApi.enabled -}} apiVersion: v1 kind: ServiceAccount metadata: -- GitLab From 26cdc5134a01b3ddeec916a5d8c04f8521c0ed7d Mon Sep 17 00:00:00 2001 From: lpapadopoulos Date: Mon, 27 Jul 2026 09:40:25 +0300 Subject: [PATCH 4/7] feat: peering vault sidecar --- charts/hypo/templates/vault/job.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/charts/hypo/templates/vault/job.yaml b/charts/hypo/templates/vault/job.yaml index 5e3e753..2fc74c2 100644 --- a/charts/hypo/templates/vault/job.yaml +++ b/charts/hypo/templates/vault/job.yaml @@ -130,7 +130,10 @@ spec: cat > hypo-peering-policy.hcl < Date: Mon, 27 Jul 2026 12:00:28 +0300 Subject: [PATCH 5/7] feat: peering vault sidecar --- charts/hypo/templates/vault/job.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/hypo/templates/vault/job.yaml b/charts/hypo/templates/vault/job.yaml index 2fc74c2..6bdb1bf 100644 --- a/charts/hypo/templates/vault/job.yaml +++ b/charts/hypo/templates/vault/job.yaml @@ -129,10 +129,10 @@ spec: ttl=1h cat > hypo-peering-policy.hcl < Date: Mon, 27 Jul 2026 12:57:16 +0300 Subject: [PATCH 6/7] feat: peering vault sidecar --- .../templates/peering-api/deployment.yaml | 4 +++ charts/hypo/values.yaml | 29 ++++++++++--------- 2 files changed, 19 insertions(+), 14 deletions(-) diff --git a/charts/hypo/templates/peering-api/deployment.yaml b/charts/hypo/templates/peering-api/deployment.yaml index f968d94..390c902 100644 --- a/charts/hypo/templates/peering-api/deployment.yaml +++ b/charts/hypo/templates/peering-api/deployment.yaml @@ -87,6 +87,10 @@ spec: value: {{ $postgresqlDb.auth.password }} - name: _PROD_QUARKUS_OTEL_EXPORTER_OTLP_TRACES_ENDPOINT value: http://{{ template "hypo.otel.url" . }}:{{ include "hypo.otel.port" . }} + - name: PEERING_VAULT_TOKEN_PATH + value: {{ $peeringApi.env.PEERING_VAULT_TOKEN_PATH }} + - name: _PROD_QUARKUS_REST_CLIENT_REGISTRY_API_URL + value: http://{{ template "hypo.registry-api.url" . }}:{{ $registryApi.service.port }} resources: {{- toYaml $peeringApi.resources | nindent 12 }} volumeMounts: diff --git a/charts/hypo/values.yaml b/charts/hypo/values.yaml index b5a8981..970bdad 100644 --- a/charts/hypo/values.yaml +++ b/charts/hypo/values.yaml @@ -19,7 +19,7 @@ portal: secret: "CHANGE_ME" image: - repository: + repository: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.portal/web/hypo-portal pullPolicy: Always tag: "1.0.0" @@ -74,7 +74,7 @@ tmf-api: startup_spec_data: false image: - repository: + repository: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.api/tmf/tmf-api-jvm pullPolicy: Always tag: "1.0.2" @@ -126,7 +126,7 @@ pkg-manager: replicaCount: 1 image: - repository: + repository: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.core/pkg-manager.helm/pkg-manager pullPolicy: Always tag: "1.0.1" @@ -170,7 +170,7 @@ oss-client: replicaCount: 1 image: - repository: + repository: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.clients/oss/oss-client-jvm pullPolicy: Always tag: "1.0.0" @@ -227,7 +227,7 @@ sonata: name: sonata replicaCount: 1 image: - repository: + repository: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.core/sonata/sonata-core-jvm pullPolicy: Always tag: "1.0.0" @@ -280,7 +280,7 @@ portal-cart: replicaCount: 1 image: - repository: + repository: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.portal/cart/hypo-portal-jvm pullPolicy: Always tag: "1.0.1" @@ -327,7 +327,7 @@ telemetry-client: replicaCount: 1 image: - repository: + repository: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.clients/telemetry/telemetry-api-jvm pullPolicy: Always tag: "1.0.0" @@ -374,11 +374,12 @@ peering-api: replicaCount: 1 image: - repository: + repository: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.api/peering/peering-api-jvm pullPolicy: Always tag: "1.1.0" - + env: + PEERING_VAULT_TOKEN_PATH: "/vault/secrets/token" imagePullSecrets: - name: regcred nameOverride: "" @@ -424,7 +425,7 @@ registry-api: replicaCount: 1 image: - repository: + repository: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.api/registry/registry-api-jvm pullPolicy: Always tag: "1.0.0" @@ -468,7 +469,7 @@ fabric-api: name: fabric-api replicaCount: 1 image: - repository: + repository: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.api/fabric/fabric-api-jvm pullPolicy: Always tag: "1.0.1" @@ -814,11 +815,11 @@ kube-prometheus-stack: email_attribute_path: email # from values from token name_attribute_path: preferred_username # from values from token login_attribute_path: preferred_username # email or preferred_username or something from tokens - auth_url: + auth_url: http://__NODE_IP__:30081/realms/tmf/protocol/openid-connect/auth - token_url: + token_url: http://__NODE_IP__:30081/realms/tmf/protocol/openid-connect/token - api_url: + api_url: http://__NODE_IP__:30081/realms/tmf/protocol/openid-connect/userinfo role_attribute_path: (contains(roles[*], 'grafanaAdmin') && 'GrafanaAdmin') || contains(roles[*], 'admin') && 'Admin' || -- GitLab From addc1b6dff4beecd88fc183f3ff4749d4b09690d Mon Sep 17 00:00:00 2001 From: lpapadopoulos Date: Mon, 27 Jul 2026 16:28:21 +0300 Subject: [PATCH 7/7] feat: peering vault sidecar --- charts/hypo/templates/peering-api/deployment.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/hypo/templates/peering-api/deployment.yaml b/charts/hypo/templates/peering-api/deployment.yaml index 390c902..73f6052 100644 --- a/charts/hypo/templates/peering-api/deployment.yaml +++ b/charts/hypo/templates/peering-api/deployment.yaml @@ -2,6 +2,7 @@ {{ $vaultServer := index .Values "vault-server" }} {{ $postgresqlDb := index .Values "postgresql-db" }} {{- if $peeringApi.enabled -}} +{{ $registryApi := index .Values "registry-api" }} apiVersion: apps/v1 kind: Deployment metadata: -- GitLab