fix: 2288 correct captcha version, module names, P12 paths, and mock-rp OIDC config - #310
Open
bhumi46 wants to merge 20 commits into
Open
fix: 2288 correct captcha version, module names, P12 paths, and mock-rp OIDC config#310bhumi46 wants to merge 20 commits into
bhumi46 wants to merge 20 commits into
Conversation
…rp OIDC config - Bump captcha chart to 0.1.1 to match the deployed version - Give each esignet instance a unique captcha module name (esignetgomosipid1/2, esignetgosunbird) - Fix MOSIP_P12_PATH filenames per instance (mosipid1.pfx, mosipid2.pfx, mock.pfx, sunbird.pfx) - Remove duplicate MOSIP_ESIGNET_CAPTCHA_MODULE_NAME entry from mosipid1 extraEnvVars - Add mock-relying-party-ui OIDC client config (CLIENT_ID, ACRS, DISPLAY, GRANT_TYPE, CLAIMS_LOCALES, SCOPE_USER_PROFILE, CLAIMS_USER_PROFILE, CLAIMS_REGISTRATION, FALLBACK_LANG, AUTHORIZE_ENDPOINT, CODE_CHALLENGE) across all instances in both esignet-standalone and esignet-standalone-2.0.0 profiles - Add mock-relying-party-service valuesFile (mock-replying-party.yaml) with PAR-related extraEnvVars, wired into all 4 mock-relying-party-service-go* apps mosip/esignet#2288 Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (16)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Add inline notes throughout ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md covering the esignet-standalone-2.0.0 (Go) profile alongside the existing esignet-standalone (v1.7.1) instructions: - -go namespace/hostname equivalents in the instances table - shared mosipid1/mosipid2 domain variables and captcha/signup secrets (no separate _GO secrets) across both profiles - profile dropdown values per workflow step, noting Step 1 (external services) always uses esignet-standalone regardless of which esignet profile is deployed - verification commands and expected URLs side by side for both profiles - MOSIP ID onboarding note on allowed-domain-uris when both profiles point at the same remote MOSIP environment Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…E-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…e/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…ANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…cretKeyRef CodeRabbit flagged MOSIP_P12_PASSWORD and CRYPTO_ENCRYPTION_KEY as hardcoded credentials (CWE-798), duplicated identically across all 4 esignet-standalone-2.0.0 plugin-values files. Replace with valueFrom.secretKeyRef pointing at a new shared esignet-go-crypto secret. - esignet-preinstall.sh (shared by all 4 esignet-go-* instances) now mints esignet-go-crypto in the captcha namespace from two new required GH Actions secrets (ESIGNET_P12_PASSWORD, ESIGNET_CRYPTO_ENCRYPTION_KEY) and copies it into each instance's namespace, following the same pattern already used for captcha secrets - helmsman_esignet.yml: wire the two new secrets through env passthrough, masking, and validation (required only when profile == esignet-standalone-2.0.0) - Deployment guide updated with the two new secrets Existing values are preserved (not rotated) to avoid breaking anything tied to the current P12 keystore files — the secret material now lives only in GitHub Environment secrets, never committed to the repo. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ntegration, PKCS12 for mosipid1 Follows mosip/esignet#2331 (Keymanager integration changes), which removed MOSIP_P12_PASSWORD/CRYPTO_ENCRYPTION_KEY from the chart entirely in favor of KEYMANAGER_* config: - mock/mosipid2/sunbird: KEYMANAGER_KEYSTORE_TYPE PKCS11, using each instance's existing esignet-softhsm-go-* secret for KEYMANAGER_PKCS11_PIN; module path corrected to the real /usr/lib/softhsm/libsofthsm2.so from the now-merged upstream chart (was a placeholder) - mosipid1: KEYMANAGER_KEYSTORE_TYPE PKCS12 instead, using the extraVolumes/extraVolumeMounts capability added in mosip/esignet#2333. esignet-mosipid1-preinstall.sh now generates a throwaway self-signed PKCS12 keystore (create-if-missing, so it stays stable across redeploys) in secret esignet-keystore-go-mosipid1, bulk-imported via extraEnvVarsSecret for KEYMANAGER_PKCS12_PASSWORD and mounted at /home/mosip/keys/secret for KEYMANAGER_PKCS12_FILE_PATH - Removed the now-unused ESIGNET_P12_PASSWORD/ESIGNET_CRYPTO_ENCRYPTION_KEY GitHub secrets wiring from helmsman_esignet.yml and the deployment guide — no GH secrets needed for either keystore approach anymore mosip/esignet#2333 Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Use a fixed known value instead of a randomly generated one — this password only protects a throwaway self-signed dummy keystore generated by this hook, not real production key material, so a shared known value is acceptable here. mosip/esignet#2333 Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Correctness/security fixes:
- helmsman_esignet.yml: use env.PROFILE (not the empty push-event input) in the
MOSIP DSF check condition
- helmsman_esignet.yml, helmsman_testrigs.yml: enforce mosipid1_domain_name/
mosipid2_domain_name as required instead of silently accepting empty values
- helmsman_testrigs.yml: bind workflow inputs to env: and reference them as
shell variables instead of interpolating ${{ }} directly into the script
body (GitHub Actions script injection hardening)
- esignet-misp-onboarder-postinstall.sh: always restore Istio injection before
returning, exit nonzero on job failure instead of continuing to restart
dependent workloads, stop masking rollout-status failures
- esignet-misp-onboarder-preinstall.sh: add an EXIT trap to restore Istio
injection if the hook fails partway, so a failed preinstall doesn't leave
the namespace permanently without sidecar injection
- kernel-preinstall.sh: validate MOSIP_API_HOST/MOSIP_API_INTERNAL_HOST before
creating the domain-config configmap instead of silently defaulting to empty
- softhsm-esignet-postinstall.sh: fix the copied configmap name
(esignet-softhsm-share -> esignet-softhsm-go-share, matching what the
mosip/softhsm chart actually creates) and stop suppressing copy failures
- signup-service-preinstall.sh: restart the captcha deployment when the
signup-go secret is updated on an existing deployment, not just on first
creation, so key/secret rotations actually take effect
- trigger-test-jobs-esignet.sh: distinguish genuine NotFound from other
kubectl failures (RBAC, credentials, API errors) in the CronJob existence
check, CronJob list, and Job status polling; separate local declarations
from command-substitution assignments so exit codes are captured correctly;
propagate signup/signup-go job failures into OVERALL_SUCCESS instead of
discarding them
- 4x apitestrig-esignet-*-setup.sh: create the s3-esignet-*-apitestrig and
apitestrig-esignet-*-apitestrig secrets referenced by extraEnvVarsSecret,
which nothing was creating before
- esignet-mosipid1/2-plugin-values-2-0-0.yaml: LOGGING_LEVEL DEBUG -> INFO
Documentation/consistency fixes:
- Replace stale "eSignet 1.7.1" banners/headers with "eSignet Standalone 2.0.0"
across hook scripts, and correct documented env var defaults to match code
- esignet-dsf.yaml, testrigs-dsf.yaml: correct stale v1.7.1 references in
comments and a commented-out postInstall path
- captcha-postinstall.sh: fix header docs to match the actual env var names
and default namespace
- aws.tfvars: close an unclosed <mail-id> placeholder
- Remove stray trailing blank lines / extra blank lines in two values files
- ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: fix markdownlint MD028/MD029/MD031
violations, correct the Steps 2/4 profile-acceptance note, remove
unconditional signup CronJob verification commands (Step 3 isn't ready for
either profile), and extend the MOSIP-ID2 allowed-domain-uris example to
cover shared MOSIP-ID2 environments
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…id2 cronjob checks in docs
- helmsman_esignet.yml: bind github.event.inputs.enable_mosipid2 to a
step-level env var in the validate-inputs job's "Validate required
variables" step instead of interpolating ${{ }} directly into the shell
condition (same script-injection hardening pattern already applied to
helmsman_testrigs.yml)
- ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: make the esignet-mosipid2 /
esignet-go-mosipid2 CronJob verification commands conditional on
enable_mosipid2, matching the pattern already used for the pods-check
section earlier in the guide
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
0.1.1to match the deployed version (esignet-standalone/external-dsf.yaml)esignetgomosipid1,esignetgomosipid2,esignetgosunbird) so module names don't collide across servicesMOSIP_P12_PATHfilenames per instance (mosipid1.pfx,mosipid2.pfx,mock.pfx,sunbird.pfx)MOSIP_ESIGNET_CAPTCHA_MODULE_NAMEentry from the mosipid1extraEnvVarsCLIENT_ID,ACRS,DISPLAY,GRANT_TYPE,CLAIMS_LOCALES,SCOPE_USER_PROFILE,CLAIMS_USER_PROFILE,CLAIMS_REGISTRATION,FALLBACK_LANG,AUTHORIZE_ENDPOINT,CODE_CHALLENGE) across all instances in bothesignet-standaloneandesignet-standalone-2.0.0profilesmock-relying-party-servicevaluesFile (mock-replying-party.yaml) with PAR-relatedextraEnvVars, wired into all 4mock-relying-party-service-go*appsFixes #2288
Test plan
helmsman -f Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml --applydry-run validates cleanlyesignet-standalone-2.0.0profile and confirm captcha module names resolve without collision🤖 Generated with Claude Code