Conversation
…rp OIDC config - Bump captcha chart to 0.1.1 to match the deployed version - Give each esignet instance a unique captcha module name (esignetgomosipid1/2, esignetgosunbird) - Fix MOSIP_P12_PATH filenames per instance (mosipid1.pfx, mosipid2.pfx, mock.pfx, sunbird.pfx) - Remove duplicate MOSIP_ESIGNET_CAPTCHA_MODULE_NAME entry from mosipid1 extraEnvVars - Add mock-relying-party-ui OIDC client config (CLIENT_ID, ACRS, DISPLAY, GRANT_TYPE, CLAIMS_LOCALES, SCOPE_USER_PROFILE, CLAIMS_USER_PROFILE, CLAIMS_REGISTRATION, FALLBACK_LANG, AUTHORIZE_ENDPOINT, CODE_CHALLENGE) across all instances in both esignet-standalone and esignet-standalone-2.0.0 profiles - Add mock-relying-party-service valuesFile (mock-replying-party.yaml) with PAR-related extraEnvVars, wired into all 4 mock-relying-party-service-go* apps mosip/esignet#2288 Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (16)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Add inline notes throughout ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md covering the esignet-standalone-2.0.0 (Go) profile alongside the existing esignet-standalone (v1.7.1) instructions: - -go namespace/hostname equivalents in the instances table - shared mosipid1/mosipid2 domain variables and captcha/signup secrets (no separate _GO secrets) across both profiles - profile dropdown values per workflow step, noting Step 1 (external services) always uses esignet-standalone regardless of which esignet profile is deployed - verification commands and expected URLs side by side for both profiles - MOSIP ID onboarding note on allowed-domain-uris when both profiles point at the same remote MOSIP environment Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…E-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…e/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…ANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…cretKeyRef CodeRabbit flagged MOSIP_P12_PASSWORD and CRYPTO_ENCRYPTION_KEY as hardcoded credentials (CWE-798), duplicated identically across all 4 esignet-standalone-2.0.0 plugin-values files. Replace with valueFrom.secretKeyRef pointing at a new shared esignet-go-crypto secret. - esignet-preinstall.sh (shared by all 4 esignet-go-* instances) now mints esignet-go-crypto in the captcha namespace from two new required GH Actions secrets (ESIGNET_P12_PASSWORD, ESIGNET_CRYPTO_ENCRYPTION_KEY) and copies it into each instance's namespace, following the same pattern already used for captcha secrets - helmsman_esignet.yml: wire the two new secrets through env passthrough, masking, and validation (required only when profile == esignet-standalone-2.0.0) - Deployment guide updated with the two new secrets Existing values are preserved (not rotated) to avoid breaking anything tied to the current P12 keystore files — the secret material now lives only in GitHub Environment secrets, never committed to the repo. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ntegration, PKCS12 for mosipid1 Follows mosip/esignet#2331 (Keymanager integration changes), which removed MOSIP_P12_PASSWORD/CRYPTO_ENCRYPTION_KEY from the chart entirely in favor of KEYMANAGER_* config: - mock/mosipid2/sunbird: KEYMANAGER_KEYSTORE_TYPE PKCS11, using each instance's existing esignet-softhsm-go-* secret for KEYMANAGER_PKCS11_PIN; module path corrected to the real /usr/lib/softhsm/libsofthsm2.so from the now-merged upstream chart (was a placeholder) - mosipid1: KEYMANAGER_KEYSTORE_TYPE PKCS12 instead, using the extraVolumes/extraVolumeMounts capability added in mosip/esignet#2333. esignet-mosipid1-preinstall.sh now generates a throwaway self-signed PKCS12 keystore (create-if-missing, so it stays stable across redeploys) in secret esignet-keystore-go-mosipid1, bulk-imported via extraEnvVarsSecret for KEYMANAGER_PKCS12_PASSWORD and mounted at /home/mosip/keys/secret for KEYMANAGER_PKCS12_FILE_PATH - Removed the now-unused ESIGNET_P12_PASSWORD/ESIGNET_CRYPTO_ENCRYPTION_KEY GitHub secrets wiring from helmsman_esignet.yml and the deployment guide — no GH secrets needed for either keystore approach anymore mosip/esignet#2333 Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Use a fixed known value instead of a randomly generated one — this password only protects a throwaway self-signed dummy keystore generated by this hook, not real production key material, so a shared known value is acceptable here. mosip/esignet#2333 Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Correctness/security fixes:
- helmsman_esignet.yml: use env.PROFILE (not the empty push-event input) in the
MOSIP DSF check condition
- helmsman_esignet.yml, helmsman_testrigs.yml: enforce mosipid1_domain_name/
mosipid2_domain_name as required instead of silently accepting empty values
- helmsman_testrigs.yml: bind workflow inputs to env: and reference them as
shell variables instead of interpolating ${{ }} directly into the script
body (GitHub Actions script injection hardening)
- esignet-misp-onboarder-postinstall.sh: always restore Istio injection before
returning, exit nonzero on job failure instead of continuing to restart
dependent workloads, stop masking rollout-status failures
- esignet-misp-onboarder-preinstall.sh: add an EXIT trap to restore Istio
injection if the hook fails partway, so a failed preinstall doesn't leave
the namespace permanently without sidecar injection
- kernel-preinstall.sh: validate MOSIP_API_HOST/MOSIP_API_INTERNAL_HOST before
creating the domain-config configmap instead of silently defaulting to empty
- softhsm-esignet-postinstall.sh: fix the copied configmap name
(esignet-softhsm-share -> esignet-softhsm-go-share, matching what the
mosip/softhsm chart actually creates) and stop suppressing copy failures
- signup-service-preinstall.sh: restart the captcha deployment when the
signup-go secret is updated on an existing deployment, not just on first
creation, so key/secret rotations actually take effect
- trigger-test-jobs-esignet.sh: distinguish genuine NotFound from other
kubectl failures (RBAC, credentials, API errors) in the CronJob existence
check, CronJob list, and Job status polling; separate local declarations
from command-substitution assignments so exit codes are captured correctly;
propagate signup/signup-go job failures into OVERALL_SUCCESS instead of
discarding them
- 4x apitestrig-esignet-*-setup.sh: create the s3-esignet-*-apitestrig and
apitestrig-esignet-*-apitestrig secrets referenced by extraEnvVarsSecret,
which nothing was creating before
- esignet-mosipid1/2-plugin-values-2-0-0.yaml: LOGGING_LEVEL DEBUG -> INFO
Documentation/consistency fixes:
- Replace stale "eSignet 1.7.1" banners/headers with "eSignet Standalone 2.0.0"
across hook scripts, and correct documented env var defaults to match code
- esignet-dsf.yaml, testrigs-dsf.yaml: correct stale v1.7.1 references in
comments and a commented-out postInstall path
- captcha-postinstall.sh: fix header docs to match the actual env var names
and default namespace
- aws.tfvars: close an unclosed <mail-id> placeholder
- Remove stray trailing blank lines / extra blank lines in two values files
- ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: fix markdownlint MD028/MD029/MD031
violations, correct the Steps 2/4 profile-acceptance note, remove
unconditional signup CronJob verification commands (Step 3 isn't ready for
either profile), and extend the MOSIP-ID2 allowed-domain-uris example to
cover shared MOSIP-ID2 environments
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…id2 cronjob checks in docs
- helmsman_esignet.yml: bind github.event.inputs.enable_mosipid2 to a
step-level env var in the validate-inputs job's "Validate required
variables" step instead of interpolating ${{ }} directly into the shell
condition (same script-injection hardening pattern already applied to
helmsman_testrigs.yml)
- ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: make the esignet-mosipid2 /
esignet-go-mosipid2 CronJob verification commands conditional on
enable_mosipid2, matching the pattern already used for the pods-check
section earlier in the guide
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…onal to maps Matches the chart-side list-to-map conversion (mosip/esignet#2380, mosip/esignet-mock-services#602): Helm deep-merges map keys across values layers but replaces lists wholesale. Converts all 6 profile override files (esignet base/sunbird/mosipid1/mosipid2 plugin values, mock-identity, mock-relying-party) from list to map format, preserving every entry including the Helmsman-escaped Handlebars template value in MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS (verified byte-identical via diff, and re-rendered against the real charts to confirm no index-keyed garbage and correct final output). Also updates a stale comment describing the old list-replace merge semantics. NOTE: requires the esignet/mock-identity-system/mock-relying-party chart PRs to be merged and republished before this is deployed - until then the charts still expect lists and this would break. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
… entries Now that extraEnvVars/extraEnvVarsAdditional are maps (commit 1f8713a), every key can be expressed as an individual dot-path set: entry directly in esignet-dsf.yaml, matching the convention already used for domainConfig.KEY/extraEnvVarsCM[n] in this same file. Removes the valuesFile: reference and deletes the source file for each of the 6 converted apps (esignet base/sunbird/mosipid1/mosipid2, mock-identity, mock-relying-party x4) once nothing references it. Verified: full-manifest helm template diff (not just env:) for every app, comparing the original valuesFile + baseline set: render against the new set:-only render - byte-identical in every case. Checked for key overlap against existing domainConfig.*/set: entries first (none found) so nothing is duplicated. Two values (MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS, CLAIMS_USER_PROFILE) are JSON-like blobs full of commas and braces, which --set's mini-language treats specially. Escaped with \, \{ \} per Helm's strvals rules, wrapped in YAML single-quoted strings in the DSF (double-quoted YAML does NOT accept these as valid escapes - caught and fixed one instance of this during implementation). Verified end-to-end three ways: Helm's strvals parser directly, YAML round-trip via an independent parser, and Helmsman's own real binary (-dry-run -debug against a local, unreachable fake kubeconfig, network-free) - its internal "values to override from env" dump shows both escaped values recovered exactly as intended before being handed to Helm. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
The extraVolumes/extraVolumeMounts chart feature these referenced was deleted from the esignet chart. Drop the corresponding set: entries. extraEnvVarsSecret[0] stays - it's the chart's pre-existing envFrom secretRef mechanism, unrelated to the removed volume-mount feature, even though it happened to reference the same secret name. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
esignet-keystore-go-mosipid1 secret is not being used. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ne-2.0.0 DSF The Go rewrite profile used a -go suffix on release/namespace/hostnames solely to avoid colliding with the parallel v1.7.1 (non-Go) profile. That profile is retired, so the suffix is no longer needed. Also consolidates the separate mosipid1 (PKCS12) and mosipid2 (PKCS11) instances into a single mosipid instance, keeping mosipid2's PKCS11 config as canonical. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ne-2.0.0 hooks Updates namespace/secret/configmap names and kubectl patches in all hook scripts to match the DSF rename, removes the 7 mosipid1-only scripts (superseded by the consolidated mosipid instance), and deletes 2 dead scripts that duplicated the shared external-dsf.yaml's own hooks and were never referenced by any DSF file. Also adds explicit cleanup of stale pre-rename captcha env var names on the shared captcha Deployment (captcha-postinstall.sh, esignet-mosipid-preinstall.sh, esignet-sunbird-preinstall.sh), so renaming the underlying secrets doesn't leave orphaned env vars pointing at secrets that no longer exist. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…sf.yaml Consolidates mosip_esignet_go_mosipid1/mosipid2 into a single mosip_esignet_go_mosipid entry, matching the DSF's mosipid consolidation. Also fixes a naming collision the plain "-go" removal would have caused: this file packs both the v1.7.1 and Go profiles' database definitions into the same flat set: maps (postgres-init-esignet, postgres-init-signup), distinguished only by the _go suffix. Dropping _go from mosip_esignet_go/_sunbird, mosip_mockidentitysystem_go, mosip_audit_go, mosip_kernel_go, and mosip_otp_go would produce duplicate keys colliding with the still-present (retired) v1.7.1 entries. Instead these 6 entries are disabled and the Go profile's hooks now point at the same physical databases the v1.7.1 profile already defines, avoiding both the collision and redundant isolated databases. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…kflows
The esignet-standalone-2.0.0 DSFs now use a single \${mosipid_domain_name}
variable instead of mosipid1/mosipid2. The v1.7.1 esignet-standalone
profile still runs two separate mosipid1/mosipid2 instances, so its
existing inputs, secrets, and MOSIPID2_ENABLED toggle are left as-is;
mosipid_domain_name and the new ESIGNET_MOSIPID_CAPTCHA_*,
MOSIPID_POSTGRES_PASSWORD, MOSIPID_KEYCLOAK_ADMIN_PASSWORD, and
ESIGNET_MOSIPID_SPRING_CONFIG_LABEL secrets/vars are added alongside
them, with validation now branching by exact profile name. Also updates
the SOFTHSM_PAIRS release/namespace list for esignet-standalone-2.0.0 to
match the renamed releases.
Note: the new MOSIPID_* secrets/vars need to be configured in the GitHub
environment before a real esignet-standalone-2.0.0 deployment run.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…net-standalone Applies the same consolidation already done for the Go profile to the v1.7.1 esignet-standalone profile: mosipid1 was always-enabled with a more complete config (captcha explicitly configured) while mosipid2 was optional and off by default, so mosipid1's config becomes canonical. Deletes mosipid2's app blocks, hook scripts, and plugin-values file, and renames mosipid1's to the consolidated mosipid name throughout the DSF, testrigs DSF, and hooks. Also fixes softhsm-esignet-mosipid1/2-values.yaml references that were left dangling by the earlier Go-profile task: those files were shared with the Go profile and got renamed/deleted there without accounting for this profile's own use of them, silently breaking this profile's softhsm-mosipid app. Both profiles now correctly share the single softhsm-esignet-mosipid-values.yaml file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Changed from 2.0.0-develop. Note: confirmed this version has the same broken list-format extraEnvVars/extraEnvVarsAdditional as 2.0.0-develop (built from release-2.0.x-beta.1, which doesn't include the develop-go map-format conversion) - the CreateContainerConfigError/YAML-parse deployment failures will persist until that's addressed separately. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
2.0.0-develop was republished correctly on 2026-09-04 (matching develop-go's map-format extraEnvVars/extraEnvVarsAdditional and range-based deployment.yaml template) - verified via a fresh helm template render, clean exit, no warnings. 2.0.0-beta.1 (the temporary pin) remains on the old broken chart structure and was never fixed, so reverting is strictly better now. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ty-ui chart versions to 0.14.0-develop Applies to all 7 instances (mock-identity-system, and the mock/mosipid/sunbird variants of mock-relying-party-service and mock-relying-party-ui) - was 0.0.1-develop. Verified via helm template against the actual 0.14.0-develop charts for all three: clean exit, no warnings. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Points at mock-identity-system.esignet-mock, needed since mock-identity-system is deployed in esignet-mock rather than the chart's default mockid namespace. Matches issue mosip/esignet#2288 item 8. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…-service/mock-relying-party-ui in 2.0.0 profile oidc-ui (mock/mosipid/sunbird): develop-go -> 2.0.x mock-identity-system: develop -> 0.14.x mock-relying-party-service (mock/mosipid/sunbird): develop-go -> 0.14.x mock-relying-party-ui (mock/mosipid/sunbird): develop-go -> 0.14.x Repositories already correctly pointed at mosipqa/*, only tags changed. Verified each tag exists on Docker Hub and renders correctly via helm template against the actual charts. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…boarder with mosipid: true esignet-mock/mosipid/sunbird image changed from mosipdev/esignet:develop-go to mosipqa/esignet:2.0.x. Verified tag exists and renders correctly. esignet-misp-onboarder: enabled: false -> true, onboarding.variables.mosipid: false -> true. Note: namespace stays esignet-mock (unchanged) while this now tells the onboarding job to act in mosipid mode - the namespace/restart-target mismatch and preinstall readiness-wait deadlock documented earlier this session are still unresolved. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Part of the namespace-targeting fix for this now-enabled onboarder. Note: the app's own namespace: field (esignet-mock) and the preinstall/ postinstall hooks' ESIGNET_NS default and hardcoded restart-target deployment name are still not updated - those still need addressing separately. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Was esignet-mock. Note: the preinstall/postinstall hook scripts default ESIGNET_NS to esignet-mock internally (no wrapper sets it to esignet-mosipid for this app, unlike the other mosipid-specific hooks), so hook-side prep (namespace creation, keycloak resource copying, readiness wait) will still target the wrong namespace until that's fixed too. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…sunbird
Value uses ${domain_name} instead of a hardcoded domain (same variable
used everywhere else in this DSF), with per-instance subdomain regex:
^https?://[^./]+\.${domain_name}$
Written as single-quoted YAML with two literal backslashes before the
dot - Helm's --set parser (strvals) consumes one backslash as its own
escape character, so a bare "\." gets silently dropped entirely (verified
empirically) and an unescaped "." would match any character instead of
a literal dot, both of which would weaken the CORS check. Verified the
full DSF-to-rendered-manifest chain: exactly one backslash survives,
correctly matches the real subdomain and correctly rejects a
dot-as-wildcard bypass attempt.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Confirmed in a real deploy: the preinstall hook did all its prep (namespace labeling, keycloak resource copying, readiness wait) in esignet-mock, while the Helm release itself deployed into esignet-mosipid (per the DSF's namespace: field) - the postinstall hook then looked for the completed Job in esignet-mock, found nothing, and failed the whole install. - New esignet-misp-onboarder-mosipid-preinstall.sh / -postinstall.sh wrapper scripts (ESIGNET_NS=esignet-mosipid, matching the pattern used for the other mosipid-specific hooks in this DSF); DSF hooks: block now points at these instead of the base scripts directly. - Base postinstall script: parameterized the restart-target deployment name (was hardcoded to esignet-mock) via a new DEPLOYMENT_NAME variable; wrapper sets it to esignet-mosipid. - Base preinstall script: removed the kubectl wait --for=condition=ready step. MISP onboarding writes a license key that esignet consumes on startup - it doesn't call esignet's own API, so waiting for esignet to be ready first was unnecessary and would deadlock once ESIGNET_NS points at esignet-mosipid (whose pod can't become ready without the key this job provides). Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ck/shared
Two real bugs found from an actual failed deploy: the job's own log showed
EXTERNAL_URL/URL/AUTHMANAGER_URL/PMS_URL all resolving to mock's/the local
shared domain instead of esignet-mosipid's, and it authenticated against
the shared local Keycloak using placeholder credentials.
domainConfig.mosip-esignet-host/mosip-api-internal-host: these are read
directly by the onboarding script (rendered as plain env vars by the
chart's templates/jobs.yaml) to derive EXTERNAL_URL and the
PMS/IDA/authmanager URLs - now point at esignet-mosipid's real values
(esignet-mosipid.${domain_name}, api-internal.${mosipid_domain_name}).
Keycloak target: switched from the shared keycloak/keycloak-client-secrets
secrets to mosipid's own. keycloak-host-mosipid/keycloak-client-secrets-mosipid
already existed (created by esignet-mosipid-preinstall.sh, which runs
earlier) and are now referenced directly - no copy needed. Added a new
keycloak-mosipid secret (admin-password key) since no stored secret for
mosipid's Keycloak admin password existed anywhere; sourced from
MOSIPID_KEYCLOAK_ADMIN_PASSWORD, the same env var esignet-mosipid-preinstall.sh
already requires. Base preinstall script gained a SKIP_SHARED_KEYCLOAK_SECRETS
flag so the mosipid wrapper can opt out of the shared-secret copy while
keycloak-env-vars (generic, no per-instance equivalent exists) stays shared.
Verified via helm template: all four secretRef/configMapRef names resolve
to the mosipid-specific resources, mosip-esignet-host/mosip-api-internal-host
render with the correct mosipid values, clean exit, no warnings.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Replaced the placeholder esignet-kc-mockusername/mockpassword values. Confirmed with the user this isn't a sensitive credential. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
POLICY_NAME/POLICY_GROUP_NAME/PARTNER_KC_USERNAME/PARTNER_MANAGER_USERNAME/ PARTNER_MANAGER_PASSWORD updated. PARTNER_ORGANIZATION_NAME/PARTNER_TYPE/ PARTNER_DOMAIN/EXTERNAL_URL unchanged. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
POLICY_NAME/POLICY_GROUP_NAME/PARTNER_KC_USERNAME. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Old completed jobs/pods from previous runs aren't cleaned up, so every run since accumulates another match for the app.kubernetes.io/instance label. JOB_STATUS previously used .items[0] (not guaranteed to be the latest), and the failure-path log fetch used a bare -l selector that concatenated tail(30) from every stale pod, making real failures hard to find in a wall of old, unrelated log output. Both now sort by creationTimestamp and target only the newest job/pod. Not independently verified against a live cluster (no access from here) - .items[-1:] is a standard kubectl jsonpath idiom, but flagging since it wasn't tested the way the DSF changes usually are. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…all.sh
The previous {.items[-1:].field} slice-plus-field-access pattern silently
returned nothing in a real run, leaving LATEST_POD empty and no logs
printed after the WARNING. Switch to the standard range+end idiom.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…isp-onboarder-postinstall.sh --tail=30 alone doesn't say WHY the container died (e.g. OOMKilled vs a normal script failure), forcing a manual kubectl round-trip against the live cluster every time. Print containerStatuses.state/lastState and bump the log tail to 200 lines so the CI output is self-sufficient. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…postinstall.sh Under set -euo pipefail, a genuine kubectl API failure (not just "no jobs/pods found") on either lookup would abort the script before the istio-injection restore ran. Add || true so only istio-injection restore and the diagnostic path run, matching the rest of the script. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
… its result
helm upgrade returns as soon as the Job object is created, not when it
finishes. The real run's diagnostics (added in the previous commit)
showed phase=Running/restartCount=0/lastState={} with newman only one
request into its first folder - the job was never failing, we were
just checking way too early. Poll status.succeeded/status.failed for
up to 10 minutes (configurable via ONBOARDER_JOB_WAIT_TIMEOUT) instead
of checking once immediately.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…-ui containers mock_relying_party_ui.AUTHORIZE_ENDPOINT/CODE_CHALLENGE only exist as values.yaml defaults in the mock-relying-party-ui chart - deployment.yaml's env: block hardcodes a specific list of mock_relying_party_ui.* keys and never references these two, so setting them had no effect on the running container. Switch to extraEnvVars.*, which the chart does wire into env:. Verified via helm template that AUTHORIZE_ENDPOINT/CODE_CHALLENGE now render as real container env vars. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
mock_relying_party_service.TOKEN_ENDPOINT/USERINFO_ENDPOINT only exist as values.yaml defaults in the chart - deployment.yaml's env: block never references them, only ESIGNET_SERVICE_URL/ESIGNET_AUD_URL/ CLIENT_PRIVATE_KEY/JWE_USERINFO_PRIVATE_KEY/USERINFO_RESPONSE_TYPE are hardcoded there. Add via extraEnvVars.*, already the pattern this DSF uses for the chart's other keys. Verified via helm template that both render as real container env vars. ESIGNET_AUD_URL is already present and wired correctly (deployment.yaml does reference mock_relying_party_service.ESIGNET_AUD_URL directly) with per-instance domain-parameterized values, so left unchanged. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
0.1.1to match the deployed version (esignet-standalone/external-dsf.yaml)esignetgomosipid1,esignetgomosipid2,esignetgosunbird) so module names don't collide across servicesMOSIP_P12_PATHfilenames per instance (mosipid1.pfx,mosipid2.pfx,mock.pfx,sunbird.pfx)MOSIP_ESIGNET_CAPTCHA_MODULE_NAMEentry from the mosipid1extraEnvVarsCLIENT_ID,ACRS,DISPLAY,GRANT_TYPE,CLAIMS_LOCALES,SCOPE_USER_PROFILE,CLAIMS_USER_PROFILE,CLAIMS_REGISTRATION,FALLBACK_LANG,AUTHORIZE_ENDPOINT,CODE_CHALLENGE) across all instances in bothesignet-standaloneandesignet-standalone-2.0.0profilesmock-relying-party-servicevaluesFile (mock-replying-party.yaml) with PAR-relatedextraEnvVars, wired into all 4mock-relying-party-service-go*appsFixes #2288
Test plan
helmsman -f Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml --applydry-run validates cleanlyesignet-standalone-2.0.0profile and confirm captcha module names resolve without collision🤖 Generated with Claude Code