From 607fcf76fa6f1a1a715fd0bc5191dcaa45128a93 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 4 Aug 2026 17:09:40 +0530 Subject: [PATCH 01/20] fix: 2288 correct captcha version, module names, P12 paths, and mock-rp OIDC config - Bump captcha chart to 0.1.1 to match the deployed version - Give each esignet instance a unique captcha module name (esignetgomosipid1/2, esignetgosunbird) - Fix MOSIP_P12_PATH filenames per instance (mosipid1.pfx, mosipid2.pfx, mock.pfx, sunbird.pfx) - Remove duplicate MOSIP_ESIGNET_CAPTCHA_MODULE_NAME entry from mosipid1 extraEnvVars - Add mock-relying-party-ui OIDC client config (CLIENT_ID, ACRS, DISPLAY, GRANT_TYPE, CLAIMS_LOCALES, SCOPE_USER_PROFILE, CLAIMS_USER_PROFILE, CLAIMS_REGISTRATION, FALLBACK_LANG, AUTHORIZE_ENDPOINT, CODE_CHALLENGE) across all instances in both esignet-standalone and esignet-standalone-2.0.0 profiles - Add mock-relying-party-service valuesFile (mock-replying-party.yaml) with PAR-related extraEnvVars, wired into all 4 mock-relying-party-service-go* apps https://github.com/mosip/esignet/issues/2288 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 143 +++++++++++++----- .../dsf/esignet-standalone/esignet-dsf.yaml | 56 +++++++ .../dsf/esignet-standalone/external-dsf.yaml | 2 +- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 6 +- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 4 +- .../esignet-plugin-values-2-0-0.yaml | 4 +- .../esignet-sunbird-plugin-values-2-0-0.yaml | 4 +- .../mock-replying-party.yaml | 25 +++ 8 files changed, 198 insertions(+), 46 deletions(-) create mode 100644 Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 55e650580..9ce3a8826 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -103,7 +103,7 @@ apps: postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh" # --------------------------------------------------------------------------- - # eSignet v1.7.1 + # eSignet # --------------------------------------------------------------------------- esignet-go-mock: namespace: esignet-go-mock @@ -122,11 +122,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -155,11 +155,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid1-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid1.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid1.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid1.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid1.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid1_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -196,11 +196,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid2-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid2.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid2.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid2.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid2.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid2_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -237,11 +237,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-sunbird-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-sunbird.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-sunbird.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-sunbird.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-sunbird.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -256,12 +256,12 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh" # --------------------------------------------------------------------------- - # OIDC UI v1.7.1 + # OIDC UI # --------------------------------------------------------------------------- oidc-ui-go: namespace: esignet-go-mock enabled: true - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -270,6 +270,7 @@ apps: oidc_ui.oidc_service_host: "esignet-go-mock.esignet-go-mock" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mock.esignet-go-mock" + timeout: 1200 priority: -13 hooks: @@ -278,7 +279,7 @@ apps: oidc-ui-go-mosipid1: namespace: esignet-go-mosipid1 enabled: true - version: 0.1.0-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -295,7 +296,7 @@ apps: oidc-ui-go-mosipid2: namespace: esignet-go-mosipid2 enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -312,7 +313,7 @@ apps: oidc-ui-go-sunbird: namespace: esignet-go-sunbird enabled: true - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -380,11 +381,15 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -397,11 +402,15 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -414,11 +423,15 @@ apps: enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" - image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth/v2/token" + image.tag: "develop-go" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -431,11 +444,15 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-sunbird.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -458,6 +475,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go.${domain_name}" wait: true timeout: 480 @@ -480,6 +511,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid1.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go-mosipid1.${domain_name}" wait: true timeout: 480 @@ -502,6 +547,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid2.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go-mosipid2.${domain_name}" wait: true timeout: 480 @@ -524,6 +583,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-sunbird.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go-sunbird.${domain_name}" wait: true timeout: 480 diff --git a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml index bdeb831ef..5db2e94be 100644 --- a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml @@ -443,6 +443,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices.${domain_name}" wait: true timeout: 480 @@ -463,6 +477,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-mosipid1.${domain_name}" wait: true timeout: 480 @@ -483,6 +511,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-mosipid2.${domain_name}" wait: true timeout: 480 @@ -503,6 +545,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-sunbird.${domain_name}" wait: true timeout: 480 diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index c25538342..f44e721d9 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -512,7 +512,7 @@ apps: captcha: namespace: captcha enabled: true - version: 0.1.0-beta.1 + version: 0.1.1 chart: mosip/captcha set: metrics.serviceMonitor.enabled: "false" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index efeb38505..697de99b0 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -9,8 +9,6 @@ extraEnvVars: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet - name: REDIS_HOST valueFrom: configMapKeyRef: @@ -64,7 +62,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/mosipid1.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME @@ -85,7 +83,7 @@ extraEnvVars: value: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetmosipid1" + value: "esignetgomosipid1" - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" valueFrom: secretKeyRef: diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 6f4317522..96e42db3e 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -62,7 +62,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/mosipid2.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME @@ -83,7 +83,7 @@ extraEnvVars: value: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetmosipid2" + value: "esignetgomosipid2" - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" valueFrom: secretKeyRef: diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index 699de0f37..6f53b8731 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -22,7 +22,7 @@ extraEnvVars: name: esignet-captcha-go key: esignet-captcha-site-key - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet + value: esignetgo - name: REDIS_HOST valueFrom: configMapKeyRef: @@ -76,7 +76,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/mock.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index d579720f6..54f52350c 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -10,7 +10,7 @@ extraEnvVars: name: keycloak-host key: keycloak-external-url - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet + value: esignetgosunbird - name: REDIS_HOST valueFrom: configMapKeyRef: @@ -64,7 +64,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/sunbird.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml new file mode 100644 index 000000000..152594a8b --- /dev/null +++ b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml @@ -0,0 +1,25 @@ +extraEnvVars: + - name: CLIENT_ID + value: I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM + - name: ACRS + value: >- + mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge + - name: DISPLAY + value: page + - name: GRANT_TYPE + value: authorization_code + - name: CLAIMS_LOCALES + value: en + - name: SCOPE_USER_PROFILE + value: openid profile + - name: CLAIMS_USER_PROFILE + value: >- + {"userinfo":{"given_name":{"essential":true},"phone_number":{"essential":true},"email":{"essential":true},"picture":{"essential":false},"gender":{"essential":false},"birthdate":{"essential":false},"address":{"essential":false}},"id_token":{}} +mock_relying_party_service: + host: '' + mountDir: "" # path inside docker + healthCheckUrl: + mock_relying_party_serviceMountDIr: /home/mosip/oidc/ + puburl: + privurl: + USERINFO_RESPONSE_TYPE: jwt From 411fb31d4081fbd089dc883d6714488998216742 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 4 Aug 2026 17:36:54 +0530 Subject: [PATCH 02/20] docs: document esignet-standalone-2.0.0 differences in deployment guide Add inline notes throughout ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md covering the esignet-standalone-2.0.0 (Go) profile alongside the existing esignet-standalone (v1.7.1) instructions: - -go namespace/hostname equivalents in the instances table - shared mosipid1/mosipid2 domain variables and captcha/signup secrets (no separate _GO secrets) across both profiles - profile dropdown values per workflow step, noting Step 1 (external services) always uses esignet-standalone regardless of which esignet profile is deployed - verification commands and expected URLs side by side for both profiles - MOSIP ID onboarding note on allowed-domain-uris when both profiles point at the same remote MOSIP environment Signed-off-by: bhumi46 --- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 100 +++++++++++++++++--- 1 file changed, 87 insertions(+), 13 deletions(-) diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index ee2e06e61..4340b2245 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -52,6 +52,9 @@ This deployment can run up to **4 separate eSignet instances** on the same clust | **eSignet MOSIP-ID2** | `esignet-mosipid2` | A second real MOSIP identity system at `MOSIPID2_DOMAIN_NAME` | No | | **eSignet Sunbird** | `esignet-sunbird` | A Sunbird RC credential registry | Yes | +> **Deploying `esignet-standalone-2.0.0` instead?** Same 4 instances, `-go`-suffixed namespaces: +> `esignet-go-mock`, `esignet-go-mosipid1`, `esignet-go-mosipid2`, `esignet-go-sunbird`. + ### When do you need mosipid1? Use `esignet-mosipid1` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID1_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. @@ -74,6 +77,11 @@ If you only have one MOSIP system to connect to, leave mosipid2 disabled. You do > No DSF file edits needed — `enable_mosipid2` is a workflow input toggle that controls deployment at runtime. +> **`esignet-standalone-2.0.0` note:** `MOSIPID1_DOMAIN_NAME` and `MOSIPID2_DOMAIN_NAME` are the same variables +> used by both profiles — if you run `esignet-standalone` and `esignet-standalone-2.0.0` side by side, their +> mosipid1/mosipid2 instances point at the **same** remote MOSIP environment(s). There's no separate `_GO`-suffixed +> domain variable. + --- ## 1. Before You Start @@ -148,6 +156,12 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the main `esignet-mock` namespace | | `ESIGNET_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the main `esignet-mock` namespace | +> **`esignet-standalone-2.0.0` note:** `helmsman_external.yml` has no `esignet-standalone-2.0.0` option in its +> `profile` dropdown — it only ever deploys as `esignet-standalone`. The 2.0.0 profile has no `external-dsf.yaml` +> of its own; it reuses this same shared captcha/Postgres/Keycloak/Redis/Kafka/MinIO deployment (see the callout +> at the top of this guide). Always run Step 1 with `profile: esignet-standalone`, even if you only plan to +> deploy `esignet-standalone-2.0.0` in Step 2. + **For `helmsman_esignet.yml`:** | Secret Name | What it is | @@ -167,6 +181,13 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings > ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. +> **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0` +> — there are no separate `_GO`-suffixed GitHub secrets. Internally, the 2.0.0 hooks create differently-named +> Kubernetes secrets (e.g. `esignet-captcha-go`, `esignet-captcha-go-mosipid1`) and patch differently-named env +> vars onto the shared `captcha` deployment (e.g. `MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO`) so both +> profiles can coexist on the same captcha pod — but the underlying reCAPTCHA key **values** you configure here +> are shared between `esignet-standalone` and `esignet-standalone-2.0.0`. + **For `helmsman_signup.yml` (set now even though signup is not yet active):** | Secret Name | What it is | @@ -174,6 +195,9 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `MOSIP_SIGNUP_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the `signup` namespace | | `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the `signup` namespace | +> **`esignet-standalone-2.0.0` note:** Same secrets reused here too — signup for the 2.0.0 profile deploys into +> the `signup-go` namespace (vs `signup` for `esignet-standalone`) but shares these same GitHub secret values. + --- ### C. Environment Variables @@ -206,12 +230,16 @@ Step 0 → Provision Infrastructure (terraform plan / apply) ├── 0b base-infra ~10 min ← once per AWS account; skip if already done ├── 0c observ-infra ~15 min ← optional monitoring cluster └── 0d infra ~20 min profile: esignet-standalone ← the main cluster -Step 1 → Deploy External Services (helmsman_external.yml) ~20 min -Step 2 → Deploy eSignet (helmsman_esignet.yml) ~25 min +Step 1 → Deploy External Services (helmsman_external.yml) ~20 min profile: esignet-standalone (always) +Step 2 → Deploy eSignet (helmsman_esignet.yml) ~25 min profile: esignet-standalone or esignet-standalone-2.0.0 Step 3 → Deploy Signup (helmsman_signup.yml) ⚠️ IN PROGRESS — not ready yet -Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min +Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min profile: esignet-standalone or esignet-standalone-2.0.0 ``` +> Steps 2–4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy the +> Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both profiles +> share the same external infrastructure. + --- ### Step 0 — Provision Infrastructure (Terraform) @@ -349,7 +377,7 @@ All pods should show `Running` or `Completed`. | Field | Value to enter | |---|---| -| `profile` | `esignet-standalone` | +| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — see note below | | `mode` | `apply` | | `skip_mosip_dsf_check` | **tick this** — standalone has no MOSIP deployment to wait for | | `delete_existing_jobs` | tick only if re-running after a failure; leave unticked on first deploy | @@ -362,16 +390,34 @@ All pods should show `Running` or `Completed`. > **Important:** Always tick `skip_mosip_dsf_check` for standalone eSignet — without it, the workflow waits for a `mosip-dsf=completed` namespace label that will never appear (there is no full MOSIP deployment in this mode), and the workflow will fail. +> **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml` +> instead — it deploys the same 4 instances (main/mock, mosipid1, mosipid2, sunbird) plus their OIDC UIs and mock +> relying party service, but into `-go`-suffixed namespaces (`esignet-go-mock`, `esignet-go-mosipid1`, +> `esignet-go-mosipid2`, `esignet-go-sunbird`) with `-go`-suffixed hostnames (e.g. `esignet-go.sandbox.xyz.net`). +> All other fields (`domain_name`, `mosipid1_domain_name`, `enable_mosipid2`, etc.) work the same way as for +> `esignet-standalone`. You can run both profiles side by side in the same cluster — Step 1 only needs to be run +> once, with `profile: esignet-standalone`. + 4. Click the green **`Run workflow`** button ![Deploy eSignet - Helmsman](_images/esignet.png) **How to know it succeeded:** + +For `esignet-standalone`: ```bash kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird # If enable_mosipid2 was set to true: kubectl get pods -n esignet-mosipid2 ``` + +For `esignet-standalone-2.0.0`: +```bash +kubectl get pods -n esignet-go-mock && kubectl get pods -n esignet-go-mosipid1 && kubectl get pods -n esignet-go-sunbird +# If enable_mosipid2 was set to true: +kubectl get pods -n esignet-go-mosipid2 +``` + All pods should show `Running`. --- @@ -385,6 +431,10 @@ All pods should show `Running`. > **What you need to do right now:** Nothing — skip this step for now. However, make sure the signup secrets (`MOSIP_SIGNUP_CAPTCHA_SITE_KEY` and `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY`) are already added to the GitHub Environment (see Section 2) so you are ready when signup is enabled. > > This section will be updated with full instructions once signup deployment is ready. +> +> **`esignet-standalone-2.0.0` note:** `helmsman_signup.yml` already lists `esignet-standalone-2.0.0` in its +> `profile` dropdown (deploys into the `signup-go` namespace instead of `signup`), but it's equally not-yet-ready +> for either profile. --- @@ -402,7 +452,7 @@ All pods should show `Running`. | Field | Value to enter | |---|---| -| `profile` | `esignet-standalone` | +| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — matches whichever profile you deployed in Step 2 | | `mode` | `apply` | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | | `mosipid1_domain_name` | MOSIP-ID1 base domain *(if MOSIP-ID1 was deployed in Step 2)* | @@ -417,11 +467,23 @@ All pods should show `Running`. ![Deploy Test Rigs - Helmsman](_images/helmsman-testrigs.png) **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created: + +For `esignet-standalone`: ```bash kubectl get cronjobs -n esignet-mock kubectl get cronjobs -n esignet-mosipid1 kubectl get cronjobs -n esignet-mosipid2 kubectl get cronjobs -n esignet-sunbird +kubectl get cronjobs -n signup +``` + +For `esignet-standalone-2.0.0`: +```bash +kubectl get cronjobs -n esignet-go-mock +kubectl get cronjobs -n esignet-go-mosipid1 +kubectl get cronjobs -n esignet-go-mosipid2 +kubectl get cronjobs -n esignet-go-sunbird +kubectl get cronjobs -n signup-go ``` --- @@ -458,16 +520,19 @@ helm list -n keycloak kubectl get pods --all-namespaces | grep -v Running | grep -v Completed | grep -v Terminating ``` +> **Deployed `esignet-standalone-2.0.0`?** Swap in the `-go` namespaces: `esignet-go-mock`, `esignet-go-mosipid1`, +> `esignet-go-mosipid2`, `esignet-go-sunbird`. `keycloak` is shared, so `helm list -n keycloak` is unchanged. + **Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain): -| Service | URL | -|---|---| -| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | -| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | -| Keycloak | `https://iam.sandbox.xyz.net` | -| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | -| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | -| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | +| Service | esignet-standalone URL | esignet-standalone-2.0.0 URL | +|---|---|---| +| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | `https://esignet-go.sandbox.xyz.net` | +| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | `https://healthservices-go.sandbox.xyz.net` | +| Keycloak | `https://iam.sandbox.xyz.net` | *(shared — same URL)* | +| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | `https://esignet-go-mosipid1.sandbox.xyz.net` | +| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | `https://esignet-go-mosipid2.sandbox.xyz.net` | +| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | `https://esignet-go-sunbird.sandbox.xyz.net` | --- @@ -510,6 +575,15 @@ mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet. Replace `` with your eSignet standalone base domain (e.g. `sandbox.xyz.net`). +> **`esignet-standalone-2.0.0` note:** Since `MOSIPID1_DOMAIN_NAME`/`MOSIPID2_DOMAIN_NAME` are shared between both +> profiles (see [Section 0](#0-understanding-the-esignet-instances)), if you're running `esignet-mosipid1` (v1.7.1) +> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment, add **both** hostnames to +> `mosip.ida.allowed.domain.uris`: +> ```properties +> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1. +> ``` +> Otherwise, only add the hostname for whichever profile(s) you actually deployed. + Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c) After committing these changes, restart the `id-authentication` pods on the MOSIP platform so the config server picks up the new values: From 27269edae60d7f1efb69b78998a433c98eef5b23 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:10:52 +0530 Subject: [PATCH 03/20] Delete terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../infra/esgotest-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 9681f1e26..000000000 --- a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - server: https://172.31.66.49:6443 - name: esgotest -contexts: -- context: - cluster: esgotest - user: esgotest - name: esgotest -current-context: esgotest -kind: Config -preferences: {} -users: -- name: esgotest - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From b90214854ea5e8bfd34223426c53faf550cc18eb Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:10:59 +0530 Subject: [PATCH 04/20] Delete terraform/implementations/aws/infra/esgotest.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/esgotest.yaml | 1 - 1 file changed, 1 deletion(-) delete mode 120000 terraform/implementations/aws/infra/esgotest.yaml diff --git a/terraform/implementations/aws/infra/esgotest.yaml b/terraform/implementations/aws/infra/esgotest.yaml deleted file mode 120000 index 06f0a3f0c..000000000 --- a/terraform/implementations/aws/infra/esgotest.yaml +++ /dev/null @@ -1 +0,0 @@ -esgotest-CONTROL-PLANE-NODE-1.yaml \ No newline at end of file From 065ba34d5dd1dd442aedd16b2f80cbe421acdb13 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:11:29 +0530 Subject: [PATCH 05/20] Delete terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 720fc904a..000000000 --- a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://172.31.64.165:6443 - name: esqa -contexts: -- context: - cluster: esqa - user: esqa - name: esqa -current-context: esqa -kind: Config -preferences: {} -users: -- name: esqa - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From 515e4c679f8a4ae730724b6f2db0c93bff5c266d Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:11:38 +0530 Subject: [PATCH 06/20] Delete terraform/implementations/aws/infra/esqa.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/esqa.yaml | 1 - 1 file changed, 1 deletion(-) delete mode 120000 terraform/implementations/aws/infra/esqa.yaml diff --git a/terraform/implementations/aws/infra/esqa.yaml b/terraform/implementations/aws/infra/esqa.yaml deleted file mode 120000 index 1ea779d1d..000000000 --- a/terraform/implementations/aws/infra/esqa.yaml +++ /dev/null @@ -1 +0,0 @@ -esqa-CONTROL-PLANE-NODE-1.yaml \ No newline at end of file From e7fb9fbb73d1a971b1d1a26b3bf2c9c9d30f85a0 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:11:55 +0530 Subject: [PATCH 07/20] Delete terraform/implementations/aws/infra/rancher-override.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/rancher-override.tfvars | 2 -- 1 file changed, 2 deletions(-) delete mode 100644 terraform/implementations/aws/infra/rancher-override.tfvars diff --git a/terraform/implementations/aws/infra/rancher-override.tfvars b/terraform/implementations/aws/infra/rancher-override.tfvars deleted file mode 100644 index da1b2e2eb..000000000 --- a/terraform/implementations/aws/infra/rancher-override.tfvars +++ /dev/null @@ -1,2 +0,0 @@ -enable_rancher_import = true -rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/f25prw8zrsc959n2bk25mn79twtwmpq6hpxphf9xt97dhbm797r99n_c-stb2m.yaml\"" From 5c220d08beca6c4b0cd83081b7f3d4a862a80a80 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:12:05 +0530 Subject: [PATCH 08/20] Delete terraform/implementations/aws/infra/tf-plan.gpg Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/tf-plan.gpg | Bin 61233 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 terraform/implementations/aws/infra/tf-plan.gpg diff --git a/terraform/implementations/aws/infra/tf-plan.gpg b/terraform/implementations/aws/infra/tf-plan.gpg deleted file mode 100644 index 8eb2d1bda9db8ff8dbf17cf7b47be7e317ff6e13..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 61233 zcmV(hK={9m4Fm}T3Y5mE(Xi02U;ono008eC0gg2ms-J216BdF*7{6)2Ymf_>9!T7G z!1*E3uj+?%>*3#{mZ7eAy|#$EG;_$=@42-)lEqDwu7zquQFQ>DV&_bo>(-7(Zl!LQ zc}}IO2w+j9f)D@SBnKa=$OxPlHrd+u*K;e)%xPsen$r=*HUsq5D9)c+<;bk{VMhZV z9}kPw9&P)^plvae72W>k5;HN@9-DlG&Pt;~=Y>Pg2L8R-PrWZQYJ{g7sL!4`q}Yab zJ4gDgCLCt8b4V3A1Lf4N2r(r}sm!d#7ejjuu{`3FSDbUz zfHkQQCs~b!OoMU%0;fAM8W`_tK-_(lX)Kku-|*NBoccv*73%9J&OVF9$maKeiS8L< zpd!)ccpmRCR^lv}i2*wVG38S%C_iek&3BkapjR!FPj7pKvG%UVsjPnZDzp-Nalx7% zZL*K?pB$jkEz|Vr%Of%atj%y$(q;R6d8@LIm_?b=*CB!`tPY1k<;lhB5=Wqs*vm@G z$tKoN2*MFVOKZoB7^;@Z1GpgJNd;7ny}yMqHa%}XUxt1P9gA5M1pR!xTe>RH(k(@# z!5$Tq@|-7hS3PIPbtH$f8Ild7-vluMUuh=;2v5&A3&x1oU6xSYff8STVM}7amEUuv zY9gUyOEvl9sqpLTKfjT>*bGy>e^?8h)^Tvu*6T zH89wC1Vy0ApRfTnow42}x-@OewoH~vg?rrVXdTo>?w6S8?bLzg8~>DIy6X^O$e2N5 zazm;8RLCD6Bek z8*�B;TEGL>mL`v+~9mWyGgR4sdoTqkJJNy0XF~8@O4GVF&cOMcxa2%ZDI%I~O4_ z?-T760k^SHLq)FbuZIcVHrBhHksh43sJ639N7Jz%gh^dh<5@k@-S2vbI>y+>|9)iv z8AmuEhI>Ge#~WdE_$mK=UH@>MEz2><%cJ@v{(6y8(>gx0%~>D-jz8vvo8Y-=kkGVj zM!!64DhMaNx8M;rtyWtA1lh$VQ$5iTM`6^4D)v41+DM-;AAX@FW6^r0-lg7*;GQz zZk}>{(v9bqMk-X(ko<&Yv}%UPn3b$aduJZmGCxAyx0CADm6(PCI>RVqu-Ba7@z5#U zWIQ+prbs?4plsLl9C`I9H^w90$XN6v`xwpD~83Fx7WwH?oSuK5?uD(1&IDSb~tQ&gWrAkntpLCAS9-p1y zpsoL`zV?{ZCZ35CJTWFNwQS*e!RE%@%Tx=4GEaum8fiFr$9Z0sx)cZ)tn2<&`#4A! zc*+qlqX5YDbDn`Ek>Qj#WfrKlKr&9q-6PJbF(c!4P}V;`90~DIlGoZT9lMjfTY7{Wq&&p|<&Az{xk;dDyV*`U14Dz~qB}wL+8Q(yb zXOksum#*J`^s8fH?(P%<L-&oNl%g}aR>O@>W~L?V)xPMLBUIt$8Qr8aXI zj0sV49cr`3R*X+Tw3yEYGAGKf?CJwpfy|NEKJu0ES?ciMCWm}k*$$`NaI0&U)4`J+ zWyGnDs1#o)Z_Nr%(IeoWB|^}5KxaAVeapfIbuB}~2K;ptx1sRa&BX zIHdV54-TNzzUgYI9JvgxQQeK(p{VfhrF7F_SLCPyNKnvt;~=A6QI!$c2TntKs2sA% z>t-ioh(RJb?xw%_^RWU=<#Cp`o?{dqc=pw22|RCb02Gff%@M1ShImQEI!f5jrkvm*=%UtDi4)~6peIZV<9aUPY+E3BLP z1yjsWQLG;)|J3eMd~$x_%u!6d@2T%s!C5Rrr?%_F=tN=LJSwbA@*oR=HjBoo!76?$ zGz0ZzIK1$pZ9qJ+n?L;QqT~d#%g#3Yxe6bUc@(bhKP!WodlKiL#qn&gh~YnE^=8{0 z|79*W&vVtHbx&({8|>yF!vb|7b`UP<-?6@ZUAx+DsEn?w%eRZmV)J~+*tXN_g4jYi z;6h{xys%>iTecW8uU^bW^rcW&8q;sUkC(d&X_Bhju>Hqvig4>hidD&B>W?@xcQj{d*-o)75S2d9iWS;YC_H# zVNGee^H7-n+!(y)ACN(~vDBP~HI9K7#e%81`NP-&q~bGYw8Isgpj;Qc=}s_XxEA^2+|e^ba$A z7Dzl3#CqhD>Nw`{*a`+3M`I?=hZsD}JZ3#a;b^8PK@t{q?!B%smN>Q1xkkZ2M7^=s zqj0!bnf|KyQ-IV*c}2#JWac`|qu$t!_+r)8O&u6|07%K>7m=s2CDr8}o@&E0Kq9dp zlgZgbs?!8?3ZnIMbEWAi}INDJUWk(lQ{B%maU1_dviwcr*3D1vXH5Jy-dspvUoP^d<=8c@R2d%aEue zOpMdF8Z2FCT-W8lsZ4*b{^3dJ7e}5JA|_2dD$@eQRrv!aSok;85Im1YTLkL4O%p%ZV@P#*M5!CY;mH zK>(Uj)9rLN%*YHr{HhyW*CefcQuf$WuMbfqE_PvDdcS?memVF4tLx=B{vXys0{Ul( zX&8pWzs_{3<156*o@R(0|8OwdBKs!;HKfM~j0fSvwq*290G)QPFO6n0+DOyY&168w zkLdbegZAK-vS~R4?%PMtolXq9T01hUXc7Ps4PY*z3PlwU2{%DE;`pJmf&*aK2$(eu zRwm#ph$_LOo!VV(80KGRGU+yZNfwIbGUSoR>cc#;{6j%dOVvY(}w2mpZL)+an(Mh#LKh=z;XuSds=v4It-I3*U5-Iut<|EYOhp;vl_R>=48RE0Z-u+&d_-31yzj760v)Z@dg476RY@x zs$4l6uLSGRFSFZIM4+37+hBZZ0k)?aF9%UU#tJb=yDC3-skR+t}%E*BPI zLGDq~o1xa90Bw^{rn{@a^mxm@RLFtgaoZd3M2H(DX3Eq@f;x19WW4~3EKNQ z)X{^WE-tC{uSv^gr|(Ra(H%W`hS929i7q94vybD!^Rk!f=%$+ki|TG`;4Bc=dr z0wZpwy$wJkQwc3$3Xmx?G@AG3xFVq4Jdh}!iT8qj3X+(-m{oiswr>p^D9KU_=WfO2 z6RXLycx6t+a{UrGw66M#Xer!0Y%`C|K6Ur)^VorW@G<8~_vP~TB!bAlbM3O5ytoe( z-CrniW0v~g-=ucDCsbm7%4o|PRw*Bx4z)zJ5BU)@Z13)Jy?$E^eWL1=gJtNVZ-JF8 z$)psxzQ^a$JUH8H6)rMqZfxy{2hsv>#fX*QXJ3uNmcdqZZiF4%SNggr+v?jwM;QI3 z+1b@y&4%Fxz_p4Y*L%uW43Gl=#jc*4n>bdKD6AvPYCXo|N)G)_b}uABo?08$S`DSE z*PhY`1Wf83FQ1SevSh`g>BcGp^F!s%dy7^aYE3405v9azQYvJULKnaJF(-Gm8Fy}w zV}*Wt1;GxF(5h3eS-?hgDwF<`#X%?%wAxq4-r+#OkJWxl6Z3!)IC*UN{GM!s&7ero5$|LEnO9~JcE#rYVRV8UaV;7gemcdgyLGjI zwOF&p;qz!DDjXZe6%p2UZgun|UL5Rfdl7b;z97ok;nrFAv)d;NZ{9mrsMO-XD7wF} z`7mGt`>ctUuE;*&dWQLN!a-MI%Q4YeSIQZtOh1 z)Jf}-(okNxi1U_xAw$*v(2>j_RRWj_YI-y6d_bgh#9EJM zjg8KgWW{Q8ix;L;8wxUNIzhKEVU=c1zk&hmZ{qhTJpiOuh-*D&+d+OBaSgt}I;#kY zB;2ct1cpg8Wq^McQ@A1zj+ULp)KlyFIK09rZ0_9>G&6_rFJ2N+5XjbsCZH z>ZEY}#$y*FbXIe3CiO{}>js2C{h&JSmRVZ8j1Dn(j_OJ6e!oQ7O>_0KcO9S?*>@Ne zTkEagls@NMIxYC&6D!t7mPl%Xss7+~YfTYWOhc_{;g8W{((Q`gyL?s+@S80bx4z(+H!NG76 zxz#3^mo$%hQLFqQ*|S84vX-&vk!5_q3V)L~-7y1jW{?)Kra2 zl~(c_iNy==sY$<|I2K8_N09){C&In(1`n>dd7N#U5COt$NE)A3#H$pI>qgTt;Ngua z_9_WI+Mlf2tQ5R11D0B4@~t`C^N}CZPP|#eg@zz0b#D08rg;MKie^gj{{p-ydZ;)- zQOY>9Ief()sIwa zbP(Snzx}KXoy1p6cW?`3p^MCEjpS7GrGx=LtqoW>wtEz6Vr`q{u`vNcL+wS=CbUV5 z++1FWEMcc&5F6i-@l~0UAsLuUqt1h;Vo@*vcIjG@{dIB;nRuAkuuAK~CNBV(8R=|9 z;&{S4DU%J6M{%`Dpa^3|@4D=r467*IeGiv_V7YlsuKiR@prOGrJ}**=bwv;)0Vlv~ zHsC!#y&w&Gwu@#Sbyxs5u{VoT!};Ki8bzLSnChKo{S_R;bklJlR}{^}7Po`h1`g{0 zgprX05Mbv@vBRHv-Y|l>LnDd+0RupA3*71l7q<_8q}RYFM<{_J3l<-XGDFyG(?({b zt zex@Pj%7livq5NL*bXEWgaF`Om`*i z-S(eYL7yznAkSyJD5+?ALfNGUWAul!z1>}@tM7j$E9_MhU8HoJA?Cqr?F*XSrfzRS zQ4Z0c^xORz@?RkF3tM1vml+9|EB=tC{I_o5w)j9dD8OjUF^-t9&TrGTyPisViH8)b z9U?!-9L_F2V2n3kH{~7O00C2D%gpp?_F8wAq#rWiYnKUf12-tvq9QIqd?`UOJg#c;YS7ZVzY=5*2GVF#5MYQ2=3_M4&?}g<-B?0*@Kmsn?{ox~Me=7Dk)zE? zuXE;|-A56;IeZ6O)QoW*3(afGBZhghYdlxk1@)r{E)D~kcFj>lAi>RM>&RuLYRiK@ z5r{XZW&D5=t1SbTLvM+JAg>N$09R(V6AeG}O;hb8@h#XJYyF3A2L7)e(*G`W(zB9u zec`mYdJELoK_~pqKi_t?>;_5p)ffke(Mi~|Z%csAk?T7ckw=q}^$Z>ipr_L!qoXAP z2W1X;E5jn{*4ZN%2N44+-*)FkHf=F7(sp%BK%tcLBSIOhv9|r0! z?yY}dpNvP_G$qQdRKftSuEyS1;fEU?COgEDX6N-8YL8$o<$m|-)N`o;-y+n-qGS;% zJSBA;cO$F{dNb0`Db&u|@PvI2@@~|>lPV5>5fh|vD$PDe=85d51peAj`d{{A9^m!r zbNqV<9X&hPeA{xp`cu&aPZuFDMxg(JLy!A7AdQ8zp*n;2Bl-Gp!{Zb_owAV^bG78?xZne6cry_JGlT1ZcwzjKNB=62)C%L^XxLiPI@H(O^(X~3da2!u9`?qY{q$Qq0iCM6myy{#3ucNX$M}#$apK;J$ z5%3vveRkCRP_e`5sce9_gq|!+=X5nW<=-r8pLheK!g_A80w1CbnIHP^W=09XWNDWb zWAb>BG}NI@?ahBFS#!3ye_zv&KSGx{bb-KR2A07aS{6(psySK?n8(VFN?chhsg_Ul zG_><8A#d7?lYDhz?r*lDtfhoY(KBMB6j{!o-D(!H3dr0OuIl^_7SY(~WbfKMU_WZHjgP`1W=9haBwQ zkBOw>v}L>I|mejgh&WNC1$VO3(Dd}B41Gf+*NVRkCntkLpgeA|_h2pQu0 zyrt%?_P39^O9*nU9kx=yeL(n`cKT!oOOV^Pyf=Y?cbF?Ch{>Qrev?Yep&&vOdw8vj zyK1Npz#(evqKQ2r`U1f=glfJ%+eHLb^CU(qOfREnwr?Abgst0jT#d``K9aNF2VZW?I?zY%m|i zhL|=9DLAKS5M}XuV7o6%iyYB`RW7_Hu7=8Vyu}0Dz$1uS75J+zKbGl**Kol>E#HuC zef3Qp7q_c@GkhYUx&F~KsP#-Qx3sMwUJo<}t+VuLH8OfjfL!!Mvm9r4jR2qCQOdgw z9W2gI^GS;fRg#YHx@>R8cXnm1EJAPb8;o?RwcAR9+)8?`_lt9ALmV}?G(05IBpdg$ zU~FXmtFu6uIj6sZ=A(OD^_RH;NxS~F=eo_L;{tUxg7r*y%1=@- zl}oQlZei5g2NNHcoH|zHmk%-pt~x{dbOGC{Z?+}0pb?giq2GK}6ZA-(9k*)Tc|@e%@5u8{lO zJ=Oz~9O!wQQ%%n7N`W=nk^8A0zkx!#;U1rj`Nc>{xlnzhg&LX?af)i_0pY%Kc@ai< zx}kq}G3rEbe86vqmt#FS8#u(kp>$B+48~?}Z^PXq+<3sy?A{BU8H+27*0dw`mrKw# z51ACpIC3)M&WWL*l1ggC-Hf2Zd64L-J!uzLx$^ssWh?>JH_k$QYg8~BsEROiK1Ql4 zVKBN+jS5|cRQvDV0B56{hHTI)7xp*Mn+B4Jh;YE0uFwWfs4J@6*bhvwh9uw&d|VOV z;jb-zz#t2ZVH)kH)Huq1u@h_{2)Sl%QQQaL;vGwjE$}w1xaS+|;>TUv42YB!((wJp zq3mQ`W}6KBSS|~a_d7ceK$}=jfAs`huthYgu_ZEek1?$woa;hF_K^wVRW7oAzYR}- z3ZEcVh*m}qpX||^>(cE8?dqBN~{*zc7AS?0D$u*CM0|Dg( z$!%f^-I}84XCh_Qbr>2Y3(@hCdR2&66|)bn+dL8HfyP)mz8mdz?#*Lv%*PUHeBJ9= zgIi7)vU~p1q`>OtiO;%xr_00u+Islxs z37;^N!tq9o)JOO178)=RPFZTZ`U4K!VBh7WiR3NL#5Pwh#HGh1bXt>=GS3y@QV4?p z*kk7R5H7OTWx<<1wEA`;-ZCMf#8Di^Js$Du?yK>-aBlA`82L6ML!2GDXVO%U)jc9| z&0ca%7n1K6+%wY}_spn-%S2f>(ra~fB9t>z3>)j5A6KjV?5-qbUA6LoSYSn^^@eIgS{%bI9~NfVY;zVpXR0 zu9ZScp6$;EYo;rL0V|KXTuF*?z<&PkUhp)}DIe6sR+Wl9vQAlndp)dEQYZI*e~r+& zvo~opNZ=1vUU8<*Q5&N#j1mhwlsGY`U@|?4$BJW`e*yVbBSk6ZlfHQyTXpgT1mq%9 z_Z6o!D&jXQAs1_lY@8@nNV%dpi>Y~K>`41x@z7VjQeG5MDMQpO8|dpt#;^`XQRAySlv$2)A$f=Fi-1b;n6aTMK$UHVZ|#s zTH7xH*%NvD%^_l^eds68mnJon>G%ISaTQ%taC;3C3mRVVx8<7yQVAJPqev5^99_r zS?evk?1p%7n(jM=d+=&L_;PXQIWh~x9yxjeM2)Qd?tCV5qKUj0xU%v!Nd~!a%cZ}$HjXOIZPf^99^)~$`NH!#+;Wx*zoA}T zXqK&a{kdM;Co3J(Y~d#NR|$H7?Wt=H7%OOyA?y?ko-ziC>}cFSci|Ak!)3L#q@nDj z`;Z4cb494DtOTKAzHZ?EaPp|V<(h1>jHkf+AE?$>bEwaT>}#*xo6{9q0zjDQ;1~ku zsny`LMfiGlE!y8_V-gI$ixA2??>|ho*9Mw2x|3Gjs(6h0)*%HRw2~B7N99`$uqs+HoMkf)HTuh{|GOb-s7!tsyhz$G zOJNS$m*?e#Q$|rgw2Qh{F{IR*3B3jDBZWLLFvTWF5QcP6N9Nf~_QkfRRcqkhO)x1k zZSpf-j1F3+v*Eb~kK_HKvNlDzTae#$lRRnC(yd^BQ6XNJB`c*RlKc7bm0^v{Zr5+NFz^GN1D)aQXDw1k{U6`xMY z`o$bQ#d@>AfQtEJ#;QDh(1&bMf&%0;aV|Wwkl%EjA zQHa^|ughnUtWIirB;VDzuN*9wMyaS)(7CLGx`+jf2h?#wvc}=+*O1o7nh0SrwcgRRN63dF5U@OzHh-hJB`~QVm956E+ z+m7Dlw=Nt}FPB(I%nG^~Z2Cv6V|z^D>|*ab_E0^KS9BPzrGLycJkb6)C7I&mcQgYO zLk`E%gG=Y0%pa(8dBnHA#6Q=~b(=m|^N;o%r79%kXC>xx*rs+3-oNe6V(6|ePDvkR zn5v>{+qDxq+eO5k*ISFGp4y3L6P}36gAafWS4WSU2L`FEs_G5+C#g=I{u~KljP+GJ zH1>cjJbMe2-v*KN2bOOPdm6N^q;%ULlm`D7Bn#dVMZ(W&F;Oi)vTY3n)re3p8N0^$ z#y@X#2m=}Hz6+|vZdYKM@I=VJ9Ydka?^HM0H=>ncW!xX6z>H1fE_B{`F`OU)yLn|N z&p0A_LdnikD&3(ER#LR%X#tj2TL-;g$Q8`re7dG zt(1_EzhczyMd7Csr`=nnw9UN}1G#1Esn#Au#sA?NI~Twa%o`Ob>`ADqi=eUf-$}rl6(@J@*51)ChJwb z2OV0+t5eV6Ob}IUz8q$Mjst;M+K%<|?tyJGf)4k8TJ&I)YKLh>R`G0bpVS`Vs}@XB zTb$|M-f21Tnn79OZ=Oh`sc11}>a4mX;XzQx7!kig)*tOOJE0q#;qD7A-gW~X6<^V~ z^*(tOkkUKiYNt@l9EwlIX1_f8&+6;Wa>~$a=0+M3qE47tZ^OcdlL>N=gakw62rtdZ zdX?;tYMH+@5NEnAh_Gd(L-KH(f(I^o>VX{^hAwPzZ(j%(vef;1miq}Vx64<)%PBx7 zh=@Wy9v6^%DXG;}|6{&$l?T#7*k!+nel|UqmGzu`f!gO=G3Z6d%tN4Mu0dV(s_fV< zbA#)@-y+A#*6mAqOWcH#rQsZ+*FaIcU$#`ot^5 zQM|%ivTQ2TZ<$c0{3k$U;Db{6o8&^(1L(jJAjertX~d|Th7F)1)i{!IEBk`yGDw(o zP6095TczY>>{b!E>bI`fk8u#nXOT(MlFxrwuk*rA& z%QXtOjR&Ywpo1<_w-PV+QFmtUdL0Vf%8Z`D%MPNg>xC`*&y$EUb&NZ?R(n4H7U(DZ-F^QitA=#l-iqu)4E(u|8(b zC_{yXuQ!5zevbowCdA85enuvNl2Re0rY5K{%-wiDbxMxKfA)FS{P>W(%P>NQa~dw1x4$n^G8d^GwPj zV^#zG+GZ5*T{zK1Zf>PY6Y`|}YbYL7t4Hkyonw_#4 z-+Og_xj7IUv|(&IhG%6VrZ-(D{J|5fyRBUc!UlT`=y<|wdJ~e;UCMVJlFpQX)&|GH zfbTT#MRSAk|LMdZu08s+1kg>M@_yU?6qoviaG{~}+B8WN#Q7 z#4{GOG@It|G4-htqcV+7laDy~Sm)xqQP0B-nKmzX{7ugr(bs=oBEqAYVz5=ga-t=4ptzuOtU?9E z-Wmp(L z2NLFjQ^HLKV-{lK6cbH1k+r^b9tACF_9Y+;;ehx~REPndb+wr7Ty;amXy(V^QqLF~ z*e-7Gx*K&OPTju)ln=dOp=Sr(w>litl)S$j9cKWU!VoXpeG_n3&*0HL2mkk7zbD;z1CK#09%Np6O{b%Ysw2vJOGreYg>&sraZ+Qm;;q zjB-w!0UnV#9WsDK)B3up6>O=_La$ozc+?{tUN@MCY@Vry02v7w}I-kuJ z);O|4_|zUYp6eC!AW;Fr{y(bYnu4A92~g74r5kqm*!Cq1pM`qqq>_Br2McSYEtX#+oIIS%&!_~sx;w?&X2Dzk|M;7G&BqJR~dYuQq} zr}9he5B?;u4jC_8c^j$ufUPT0Yv1N#=d%8AlohHKc{qMyu)>~vGQw{cry;Vq`UnP0 zA#~vu{yxePzzV)aiJ}s2CE)a*dm2xcN$q05aw{@t;zpHTj0$7K74G1djJZ1TStYdR ze z+$Pmmh<9WSd43R7%aI$`Ev2Exv0IKR9eOz;s-oo=)jh&%j#$!_;ZB!pH6n=558`Fj zWA^F9KT`<7M>PSoNmi~_jl6xnaq#*ktS*0us~6=>l>qibgjdtQ_rQo0O)M+l9{8iO z>e~nTcG>vOzjEIC8hi#0H$4f zSO0JwLa@n2`j(py*p4P{w8Vkt8+lAgDLPL7W)>oH8~Vvnxk z4_j6RiRTp#Ok6x-)NGQ^tVcUCx`%ZiocXGoPK-Nk)t+KXIuNd~9h1(VUD|ezDaQuA zi6$oHtS^{sI(e(Ulc4z^ctEr?P)B)QTf{DR>JehojLRW`kw&{~s6)n>E$&c4$Ah6x z1MgBL@?AT8h0x74zRUMFuXKnKnzxvp^k=%Y`BqID?uY``J|s|_P4E0!IO7R9bd4={ z`PaWHGIP_4jnekA!9(8Sp$calD;j8Y>`nxHJ zm<8qkmxfJSpAuvc8Biu*2oM0?uMLwU?Z?Q3Nb9qN563B_Ku?6)c~~O-hyCc41E3cW2luV26SMm0-2@mIV zO7jc_8Z1P#*8CKNYh$Rv7JRbtBE6gI zNy)Pj{PL>UH)gg$GRS<|sGb}lh7IeE0Qs+UDnV3uKmM>qtOF*Iu12aD_`!8~>F99` z+N}*cxJr*#@jubB%v;^(g81)%5?MVagR|+iS~rzzB)hB;9q-2mo9gJWSHZxlyyc4&~@yGxKvqWIUrdip-b%vboA`&FRx ze&R6R5KceXffyg{Qpzzv329T>dIP(WbZsbrZ=-a7Owy%=vPHZ)OxK1ZdyD649AS9L z4QnxoOI{qp5+7B_b~GmQFY;M&D`GT$1L3UXUU~AV0I4MbiK@+Z*)ZpHk-)4R;6GF7 z3qVOTTN%8hkq3mM3s?Z)>jHXa#68>}sL>9do{$`bJ=ldnyquVK;^Ov9bijl3;Uy7G-P?Ainvs_+JF*YlP#fLQ{a0qK8@2h z#@|YvsiP7{SqG7uo%v!g7zO(_XVC7^v+9n=aJ?Nws=}#i?YC1u5N)vF>VkFkp|%-( zLc-)7K~&E7)M-ZL?l6XvI^$(1o=HH5Xlk7Tc*UKAc?pfSa$GSmU+vJ0+%MH@vP$4-Xw6#@#& z0F4$Di5L&53!B1Mp2sMSKl{dsD-IJIcv*2g1@x@wfsB=97r(=xSG8?TYBAXrOOZEc zb^)H~A_7u0eY>OO;){Y#Z7xWthLpHyQ!-?JppQC_d)11{XQ?lH!S?1dhszO)oCu#X zZ_}W%AH4*o?F`x+QPT}8KYrB#TN|ckh(igvM=F?l!1h*1j@Max3y`ip z$O7XN6tKG~1NrsXh$|>b8{nFn{p2wlr8Zx4XvTc?+g@ZFmHtzh6ei9E)-r3dhtrhF zcP5u>kU2U{g08~{Ojl*y#i`GnE1VADXCSPm-3&Zi;OL~vd>VSu9(EX9@XaV>_P_4f z&S+1pI@^cG_m)&vm#HyOd@&6_zAn_WM+gB;D;_@jtN5?E;4fxJ$-T53qfYqQVpIPG zF8k>ME0Qnw6$(?lzT%UmI;-j|S+W(&p4d5agHUR&=oRU>U+U51HY^DYQZLI|pIU+( zc4NrS%e-U^sHdZ7?k61VIqb#Y;y>BOgwxfDA-Gyn>`CiAT|AzQnvNky;w@9ok7H>D z6fSz_ToxiF;$@V~ChinCpRS#t)ndQ<{Hol5fNGS_#yEL+5G699sX|fsVLAUMW(7)W zM$`Tyr;~VhQpU}n8o%dq714TkXw-YRQE)il!gba!%uZOtjixxVZ?5DxiMQEk2YX^K z@xK{&0%J2W3+E2YXD`v6GWML- z-N?NA`cxV>n=iNka~GbD#%IF(5``Uc{=(R~jm?oS;`!VIo*QbTGe9c*^$adtn!B(U zV=%X(fYy;7BubMEG3xg=uc(PNN(^*qohaCsRY%xuJ#T>@lly`Gu zSxbT=g%RO0pjXh%6x$gJQ)i+7yn+sJS5e(|Rc+IK77eUT+Pt5OKWg+yl!R8wcaJW~ zJ@3H3f*_gAc|is4+LeD-`}4HByD{0(f8(smLE}Fje}R4}V10pW=X3@YvnBal9g+VA z!c$#?QD&7jl*qUu@)7ta~rn<|_b-$)R%Q^03YeM&nb4D|x+IP#_iSgJ;>&i_&@ zAM8Z?of^9D2#|Wj;HJ&&SjzMjBdwG^95R>;zJ|h9R~XgJL}%e_=q^Z`|96JKVd z%T0fsJdFl0L88O0wr(BNHe{gnZx9m>!H}fT3ll9kFg-Ba)=kkL;fafz%I7^SbiSJb z<}x9WtFKYAZ_1Cvtej02E_&lZ9Q2rJfDoh12zY9)1WbFlVF)wQ4nx(P##7+ub1y;3 z%E}WmaGV2DiKJ0GB=Y}%lur-Z0B|=26|wl?(vK=a$L_A71W!mLjY@9g?*G|{;wp_% z_^*ObX!$6H$_QLy!19OrW8tDRicn*u3==V-QDdU4H0tm_1?dnVRU{y&D!%cmM?xn< znEV4OJ_SwRr|HlpFyXt@Af+NszrD2?Y0dB=mu1co@&XP+(}P+(4hXNEHrB+->%iad zp2qwV$*y5XYbGvrXg2U1lT_@H5MsOgy<^&}pZger+!U}zyZ}4=b{b$9BO`oKcFTabm`Tu^Cb2J zu7gGo@K_Sx0?q&l6XS^IO%280rq6%t9UK;q+52c{Jt8ib z%JRyO#K zd_1&9GrEg7#JEU`a3UMN*t7NMfUszXXV*R%NIpI z!a=xo|K zE%0@6flFnV#P(W1dC^o-xEsCif;U$-@)>O!3aT_P6$tZpo;l#5nTf*1kaYwX&cx(?;Z6ct+!Wl(D~}xb zmg#qie0d~{^pxx|DX4#D0$77_vIPR%uyA@w7g&Qay8+*sQ+tCTIWx&3Uc;RE-iklJ z5ER5J8o`A0VlJ@v624M_WUjwMpB9CZLTQP`O9LtpuqjJe^>&|=KpE;PW&4Eh+J&v_ zC34JYxxdrOoeg@fCDkO=0>t6HyPBcN;s>;f*~omtep!^t*Y+U!)!mOf zC15|LiajJ)X$Cj_QvVx&6%ENaj6bPrp0U?4HME)|!nQs@$UqTZ4|Kny+(;1seHdRlh8W(zWojYXtty5m)WD=YP=p!#Z1#7>4 zX}l>3R{>7jG$MVP4_q_J;aU%#E}<05p$aL&7rVyzz_#(^);-2HZ!$r!b-W2FGV+qCcX0Flcixc8 z$c+1=3rEXDJb+WHJg5dvWCBsK15r{pfq&@tA^b7SwESg6K>d}>-0qv7E>iKPsRg{F zD(Zt2(x9@VcyWH4wT0_9&CL%IMzrP=L&TL;<*x+osu%o?#hy$tO1PHT>ImS9p<1U2 zPQ<{62uH>*pyOAL*jTA()pM3l9y078NyWKfY+9t_#`YE{^)bbM&kmYdp~fh?^=<~a zLxx`~?6!@iHxU3=+X9{Ovb;zwX_cce zy-%;YB^$RKt{FBp^+)0p0&EJ!A((Cw^dyU69)EAY<1pbU;O20APc*UBp4OH)<^!~s zlsAd=7SEi&oJly(Db}AEwotK|UFTG#58;zsf(I)G4@=Rlx)Ro(*>y_1K+~a}O{>Dw zDL;V>yJ)R?B_5w;+|fSQ9da#q>vS`Y_X;%LzrGxhBB($rFmAYFKIUoJKKf84R1zS6 zI)F`c$VXtW91HxqJDwQAz*#J@{mWZWSo-%nP>=lD9M^SO%M+Y+a2vM-kSJyDB?t2h z<0UBPkEqplSSIG0?;`g2_ILneh?Inij_1l+?t3F{;lyB4ceakT`VFbtmaDYmS^{>< zE9aW$u~P9ekL^4^Jve;*ir`jW_Gg!VQtH80X|m>+ zIlr}vB0i_VhTtY@H7GKT7$Y@tl{=J1k#4bzPg-cl^b@!E0V7E9es6v>eZFxnVWTKp z=Q-&o)A#RXHna`0sy?yDItuds9)?BTB5>q+ z$=$k#*STly3CjrNVi2SPWiZ-%hZEDYjclpI@$)C-d2 zka^?M*9_kpf#S84D9Yn&4Y10RJ@6xg?~iIjjTfL$R9D42ASwByL~BBqHK-&%=ky7< z`WeV{RPSU9pp{5boddy0Q+Agj;x|0G84IZVDf1yN8MKz?p0kV<Nbvm-$Z*hwe-+va6Pe|}yP3WYnsZ|WW)sCjA@ zz$qVIZpWw^WpP-4plPr#$i3xO(IK&J{GKZ9x`&C&f?S}yAc%Q4NO;ImB6;gaeg|kl z3|LN@47mz5wu)K}V>`ve#<=pFT73>ZHxSW}Pc1xbqI=2FKWJ2cF0Tl2Nfs6#>fR#) z*IvWDR}Z&9tE4-%^wJB8z0|Df?LvrM<7gEXXY7NtrDw=xX;xWejQ#rpO&Gvyr?;e^ z=njvXpl4l%)1_;hY|4C{4avV4I&KQWQK41|p(D=@p z>Z0v8^$b@fg9F#~7DMjm1>IH&tu;rF8pEN=nqNLLkzjD4-n-^2WZrL(W%;A3pWD79 z2i`;Cac+AoHbgLjLpU!(7nf@39KP%zk>FQWS9u&B3KRzXw;D&~d5v~2IIt~>`+VG& z7fTFqnc}V5Hg~nQCfEaK^HZGT7OsSoi3zr6g0YCL*cQq(-qB(i zOk`fD251dUfdFH(iY`1L@Xw=)Ek*Vlc##@Q#!$+?>#o+DC>B3bMrqDyI+bha zkPsfbUJW3of~9F9dHrxH^p%S9g$%eYXsC`-*2)jMR^_&Bg`zi`NTUmVMh%Zoxwk5m z(r)w24NAP#LlIPvK@ifJNQ6AOvl`l^A~=oO4#y`d{SRgmBuJchVc<@4o8!kfwUlYB z%b65S3_CoyEBM9n*VuneXRui3hhG(hz|TUil?c4m!^iS- zBZv8SZGa8N>ZNHE+*G^ZU()mY&Z*kR>}b|`;etOSC-SJF?so^(cP>!Z=(l=Yb-}#C z7-OmqGG_J5_Zu5)p*r+Xr6cM3`pvkh&qDmLOXP+>taY_w0$WV(gxgp{Jw#w?(+Mq- zPdUBWp|QNnX#wl1je%n8SF9mDdUUpitI>tvz0VA-4r}msq!=7wC$ptOJx4%h&Z+uH ztTfdpGuBMUwD))V?CeA>0$43tTOZBQroj~D4%o_m<3j{p9N!j}h}&x{d+@zusOjjx z=McU$ApYoRSd||yjr0(2(JWW#8c<}EX-w2@_O=Gf(K^>ct5xzaUVoee5eXV8oK$$q z!W3H|FXe7((iZ6Yp5F4u1fM1Cz?1;oaLv0VvTfZ!2m-!COFKb)U=3pTAxrbYUhQgz z7nBA!>df2Q;;!T*nCqS2Qc&DQ)7}W%B9=#xZ@JydTI$uC55GG$hdi{nj}7adZR+{C zdWE7ou30egu<)aw278L3S{>lGclrt#Q4aRXndZhhqU}M^0odiW8|z>~%T^Oin_gb` zFwRTMBC|uK8|7%d%SD14s!sJJBN0a(vPHZ+l z&A^>4WQCZ!efdEk$7{7WZK$1TVzC2PMwt1$Y#@ zjMl9D%sb>z(ZJnj-5d-!Zzc56_&QLK-R=JOGbJE-Sb zckh}ytPnni>hv_a?m=W#INPYJn;y_dBa=o#XPKP~(NBE<|2sSKcCz)-=WSOlSb;?VI)579kh zGlrfvd_&occTcKv6HpvB?>3dL6N7-@jw9kfHpD-yT~cSo>D(DVM`=AFr}LfmT%>=A z`<4(DuQGMmMC_uHy3*+rVc{C5C867709$(pD`z@NXtu04^Loj&y5zw?4+SS~=84{9 zm){?irvKioyf7GO_A6xSJ-pu;(-Sn2bKGYT?{hz^!E^V;yme+>1a)*nm8Gjj;UYKc zip$=_d_i4L+^wEbc;;X>>}*o1ab3(eB15P9;wl{fdqjZu(yAYcsr~`Tt-ezfeEw*s zA>p*86;fC#pL+D8fK%VgK!`;O#G~{ay9Nweuce@-^G^?28atB#9Y~lFv|@$OGhHqG z%}Qek`sMzi)IGbU*PG{aT4T(7+=V2R5DPrMnOP&z61`X+-Uw<~jv@#;D`*SW4ZULy zVx*??2qK-;upT8yVk4Y8)WRL?7z9)zV3i#Tc}(8#Ck8}_8cJ-pW*kjy5XvCz#})+; z)y9I)utA>W-f8w@C4#rNQqB%@IB8oBj$YZXi>o28kQ!xYREuEDV8b1v!dh(Izew?} z@*&6n!Onxue~*H*P=%6l*=DW93qlX(XQs|mD5qHevBEPs6CCJj2(jp{8n>|Z^9jFx z6c9q+3e5$xJmFz}Wkx8yqLS2*47LD$93Pg)w~*#c_jd#-PH!osy<8KPfS(VM?#DbbxX7g>IBRmy zXHf*!`(ObU5q`}G4Gce%loF8!kL`em2>$aa`WFwc7?14vwv6^EV$0BWr`Q$E38j^f zbda>d+nK+FgzOd){&}RL-mFKVnxQr za(<5)llqg~)_N^`klTSTj>7p$eNnerXIk6s=QF3%Lf%{f@gzj^gIiMQ-V_V7bgoN+ zhK31Ja6N_t(+>%QL-enJr)L>1FfjuB7B`%f8&LL zmp^xpA6tL~mJ?VWyQXQP?@h}})B2vq@_GOu7L^+~NV;zqPbMyd>g-DfrCtGmJ%=w6 zs{bSsOp_vX+FOXa#g>hq1@#^<=eyD_+~AA(r!dEcZv}Y60x_Fgm1aQTi6X}RY+-F8 zdjo~^8_75vC@lOp{`?a~=D`y)oV{xqb6|heH!T(9)~H8uC}s-3t;L;(&rRDX`k3&YYS4{%46?5#Lx52rqTix+YQu~5rlgf!O`oeD20y18iRWu z3?A$a)RrmPQHSYPL0UxNBc{2}mR0@djekmo85Wqt77@hP&N+GFmZ+xG&L)P2f^Jl@ z)~G;eZuXl(Vm);x70)PsF{n$qsCzr%GgjNC({%6aW9r_Vj*%PbEwt@L6`>-!j3pHd zXm?dBGq(CKMKJV*(MQSE-%?XItj;rp{xiDW1~iKEjaYx%XJJ#~+R9rNBU{kRYZtW5 zeXhRcxhlNa5krFHv&tywWDV@Qx;tH4P-z&meUESMUF=c;Cz4=3NTkfXs6YGm(j)mv zW*C^QC--gxyAA{rX$g5bcQwG155OCXCbqzhD}8>iBLHpf@da0z`utIQ2x|+8!@tV9 zH={pbXb}4X1c?frG?3Z=8~xuM-`pX`$v8NCaNw#r;xB}rQzW&8#&(T~Bd)}aJ@x3` zxby-E(elUL1~C5DC>#a0L1r)?5IG3LTe=GhV@II`pAOIhC)+qWA}7G|>{@CV^a(IP zhl;ycmwT?Mz@GxltAf#3|@xNRUpaY5J zLLK{I^KM2;(R8$nglNyhTQZ}Eff@yQ##*8p4*7{`0QE$D=*+oYLe?A7S7?A4m2Kcn zw$K^LV+=n5Un`8T=L{{@Une)TN zcLWQvVgJrj-?!~>m9lnj>Sg@fLQ&12#MF3UCYfq>HUpPwm`y9i`xgqppjbz#(3Vi%!3hpIAl_X$6i3#o5`KxbC;;eJls zZWwy=-)NsX0|o|RZ?-MTDv$cYXENHpE!deB|91zCPiDOA=Kx3Ik_SH(P3Jdma~mOj@1U;byah2VQEamsjr@*snAh1xmiY|%a)_tX7>($WV?PF~ zg(FXEp1%&mj`-NP;Gt3e_#PQB{9a|;e#fRHT!PtE0rP|Wq>x77MYip|K}DrxwJAV! zgOr9Ujj}KiXKSV(%>VVoT_GdYZ|NPZ1t|@S!QuDFY?RE=2@Tpn97)1OST|Y92`Bxa z=P?&iN09EDGM=lS!+1@T79x!Q52c@nl<<>73_J(rN(@+&D7((^D-)c!U20KcF)Oh1by5nlOu^8HOWGuJw z!Rv;fy~_CFO4AN}^ zhSDL|{OMfwJf4|iLG0`%Y5R2WxoIOUR9s5Cj73CvVSOBZ64o3UalNCc1Sr|SRJ)BObj-GIp)D8F8i#%`IY zdLMe@Q(Rzv8+(8#8$6`YiDjs5Yrm|aOK{0(^AqW<^!V~3Pvm3-Z0(SRD=YS9y?g-F z&626>j>6zgc$EnMtaXD1jxq2Ws0*9OSa;+Dicm%~1yd*OZ&%Z2t*n9xqRXLGS!go6 zr}eE!?I1@ef9)ig5f)(L1y5p@+DIf=e&79D28(Z&9$;*B#mRrR_Uw?K@#gv^$jxqI zgrpktJ#`VQg6loNi#u>)k;W-s8D$M`O*E9f$Xev!tWi1&+oI68sU^i&^<-nDq(7SI znh!~jQk9_bgH&-#la(!nPnHmc``jk8J1zPL-Zr+~SNC^iJ5^d+Zo*k^?AL*&Vmgsf zJu5S6J8~ce=7Zl@m__5qU2433$dK&GrdwaK>p4~RVpf5&zcqr9&zekR6gq9z!gp@u zhl>O+#f-{(g>`x}N?DZf*QrXk00dKt`#vi7bR{q;z<2``BKB%cWN0njB}sDUsW*QA z^B(`?vPnuYt+t#DhTa=h}IO(MwT}>)(g8as-!On>I_j1gRKUl*y_?{*ea3 zB{OAAORE5mbSnLVL{KEydXEh!)KA(`{3o&(O5#Y!{(6T^2se)0su~uq#OZM;s$T`M(7Q`4Vai;(TA+f6NRZ z0wz6{2&*Q$I_s|#_QA2#3S2xf%%1s@F4ZfEnXI-1l{S*9*hTwL95$2v2fP+@Mzs_? z^xr(1YsKzvd{E|FAlH;g1FEmLEoDY)ko!jYHEdYHz%lecFS3gg-!2V9f#DyfvW7s> zq6};10gzdYvJ`D0jmO}L$P0@58rcna!_ThKIcpsC@a>SKGp4^Y4FuI^Q|BA8=&g_$ z)@abvficiPp0Zujf4|G8my`V+kq#n@^l8Vhvt6Q$n$N2g3nkd07r;d6 z$o2=#oyVw9TU>vsj)zQ^p@aXRK=ZJD7(>wI00^E7^9cDV!VE5o={kFNpXD&b2hs>t zbp6yvaB4>`o}J&oy+|P9D_{JfGI@V8x_k%6CHgu|KR0WNIUF!^i_|ajwzIdAGY$=c zJqeg_ALi?9WAsSo*ePa=<%1uWFz4#fDjW1S`Wae!9t^rl(XJ)k@Beml6GtoDAZ@e! zrz$CKN)+~Rpu5Xw-kq-cJ25G980RzA+CLhN>S`HJMlIRwOpo5?aKhA zL&hS@w*g7C(cRPav7k6sdx52NS0o5Pzx1pos~kK7(*_yu5;5m_W@j(m1z`Q_GIeyw zqA_P&Jth|`@O)2=hH|%zHO-p!^13!PH#_1ia#?kQ-mWZ3iMawY;5+;%iakDe;<~b_ z#2M(3wt|wd%hxcg@CRHd(@8f+yMNPdQ@L>7d*X`P>hk6rocZtH`I_LpF(Kj~dZK@i zWaCn$CLQU(+X!>*&G!VVa+F2NZobi-fDz5%zI^6& zZ10|6nWmIQgBj3~s z1eW4Pa9v3IEL>=20oHR67H}L?BIRv3Ks905gM7n$w0C^Qw6ZcF9Lb;H!g{Dj^~^$b z(|9py&OqQ1kmLBwh#`643f&$UR+!qa%a20yHhG_pQh#q2%QZ*^h=4*TZLE*6wsVu~ z1+(YE2K<)L2+U>^W&kv|3=pRhT1=Ls%I135@qQvdJm1Y?7&m0GO}mY_ELlH~4%gOA zlq5kdCuOIpk=dkWA$)Tt@K_!eSDkE1fFgq>+iYS~-{?U!fpTakzs?Xc5G`63_it%q zLLFM4$?3HA4(N|9hDKIS!Hyendqyc5#*t0)Y?DmirT#&N^G~3SzdkFaDJ0VQ;X}O? zL0F#!r4v<@I37=P#t$5msMI@n;$@T}$KlW3;}i$simQ*O!?iSCUGi9Cwh>uzTvojYe>aO?GOk%fjDThCzEQye_rV#YxPr0Po1gfIeJ;TVNJ zIE-7Nd3@Q`3as)h z4Lo2O&7`7&DgyVWA1y(#`+|mc_%qMTcWp5Eo4D08Fk28$XvZ5i6T3S*pQ z(X#@Qpbeg5ZG$51ekplMIn_J!n1$HoyCnq%u~ur8KdI~=Jk;wpPQU-$pFw8qI}^JAA&_Fbpw9$ zQ)EZ4z}(ovn5rjc^c~sj&k}<1#>G;1QdXfu*jG8&2MQG<>ePnMzy(8Ph#qY4=H?ro z6pK3>83V@yr3X$N2Ys4$30$`5PXr~hXw{Hrs%(eefcm>1QtnswrKe`9%V$n%t&}TGf2X?OzG_ zZfL-BP6GGK^hhrhB7k-KE@Y*(0uDX~1then&MyENk<2mc$iOYneu!es(zDnzGD&+) zU5}3tp;SKzkV7&6X{Hg0Q>Gj`!^@{);Im}O%8dZ^9@ViWP~fsRpalcuaHad|#sq3K z5H?Bb!tIA^FTGLZgzpD1VG|6Mxq|}5$c9OglA>59)LMe+4-?8hzf8Am9DU-IL{yYY zSU_7z!%z<7DLGIS{-x6&_83@ONXzA?F5;2+(80}h=Qlg(T9DZVH(CM39sAxtZH$N*4TJtP&2pew4xk z$seL$DpA(*0qjI*iLWbQ*lVsi-SE4%$E!x<@yeRG@w>5MWL;N;<`c>7y% zV`p+q9-~i+hWRY}{wbh^aiim6y>XbXO(1qtRxm6R#_bw11MzDF6)%0PKNRVI_0-tT z1%Ug{0av7zO-==|4WK5E74UL(12{)7U)JR_`0_NPfgpwn!uLEvKbSYaZ*OrEl(nJgSWSVffcA4Jia)x zxywrplgr*pfZ(#q^-l(foX;B(3-1IVcF_apCqYiHCL`5nu?fV<3TTSbM zZ35K>p6>v@8QV>bCHx0h*MIf|aUB^u#M={ob$5WEcJ``O4dXfiVV^1-P*$(bbV297E-*{L zMws@=Pt4bY1or25R--37>S+aHCJEiB9LI}?^>>2*d!`&zw=*Dm07g6BK#YoK{=uVY zbUOy4z@s*(0j3iy0y3@8qC+o15CwW(q+s<>2m+{@s=XHh~QM> z`)Sk9i}=%Ariy1gw>ej@Jm7l0ZxKSq=;Ntl%;?(OhT-XEnm0y!X}~mN`nsCVh)Ur? zd5T(?aXzvaG_-#{i-0@d3=^_zQxTbK|9Ly<>-wRo9%dA`!?->m0Cj0dJfP@tHgas# zcZrqGFO|HCzON7cJZ_%e9VWdrpC4xw@6bwjR(3U(zKjOLR&Gx2&@M)cY$>(YR|u+2W%4gM3C9FM83&Tt0SK$M97g?eV+}FZ72Gqv*qeQ;=+Z;PQEPY z{1F^+0flKG`Yh4L^`j5#ACu6wy+V{_hB-gUy1J>Rn&JEjhwU1r3Y`K zQ0dnVx^>RShxM|>6~u;BlRtGw;}_u5?EyH>;5g$}x27j{k@d>G>mhAKoQ(yWu8!&uX$Bp(n(Y6kgMnsnP*r=3*t#V#dzDh`31$U>-MOnKkEZrl4z*VXaCfcHFE zoT%rKn~7Q`%sul9dDzxZ@uj=a|6g7mw`YdTOhcqz=UoMqfBj~Z9&M2r%Od|{Ht1+H zL8l83IiQ_7_BfyJ=09!zV`g7SP*SI4gj_L>it~cM_(r@B|nEw zG9#$6?wzV&EzLF~W(?sjON|;vYW+( z6?dt8IPY=O3I22t)52A(z&pJ^z<Bi1%K2qD-Vohv7~o_ zVEg)Bv);B85s9D}4;5hY|8v}rvxcD21s@`6;TBe%3xg52uI5nK%Z&tI2`iMRc;w`i zdWLX@mN)Sm7%4-kP@%Q=0NnAxonG-xl35V`5!rdy&aU!Vc>{!^#L9b)G^K~dbwttQ zd!7w(c`rR#?u1t?4kW$j;Z z=(d&P=ftZxikH!D@4S+nlXgF2HK0wYN0;qF5 z8Q++rv8Y~Mw6pb4e`XE8thyOp>ow_WwCt*YH#Q|n=EHZAa7U_ur3XmnExz&0J1?WcYp7W{KQh0Gawj15DRX?bCWrN?+@1Pti-7UcjvQIYZ5Uz;YJ^Gx3>N(m=_8B)f z7ds@ZD$=>ohhTPD4n^ePg3k4vfnA9_A_rqn@Y8MPQ~SD7D0~_4wA3Mhqy$(=?`Jx( z8?u@WI{@UZzcCWP4L6mYu*mae6WXTod07%3le2- zYFrk_U^PPlN^W7folAKeX2B0g*pQ2EXW>&U)lF_-1XqgykW~)DdbXZ)ud!dOv@&bt ztO3?gK=XeJ(|O^XX58jV3jd|OVhfMvl*=KlOAqxb>aHspUqa&n!Wlrr$iRfaU;z`G6^CWXiN-G;$XXlxS_LEzC=?3X`+Rjo__tWpr zO7e<300olrOB6gMrYjgL;_@9*Q*wBg+;x?fPA~zB_#Y6z(2kYvwEpTX*XQJO46q&> z%8<4+mh4O!_@`s}Vc*CS8{xNe!|LozVJ*GtXXee*Qzkc;#o}Ri-pC@pJ!6l8x9I>t zZEVqenKCh|>-+(S0&#)|b7pp+fXOd<6NXuzEv%ieN<>-?HkFoKSBx}B>A9yPFo)c? zXh$5L)|ln4tHyd!P6;J74(75m>0a@Tq*TAn`ht>g@<^EwfRn$ceuvZG4Yk%_iCghj zk6WnCVn6e~&K|rGE+m7NzxQ{+fddF56p0)kSGf?02(}lAL01HO;uWIRFX__@Ww1F> zW}*aUTx&Z7-;%dUSNi+M{CSax+~6grIl3u8g91IQ zXwM=H#U#)RO8a_FxC|4tP*MX=%yoKv3@WQjkhM~a2SRh$kcKVlb(Y&Jzcd&_GOGH? z=fNZuZS2+^J@T0hAvz!naC$GH;n%QkY^-BWu9Egjf>d<-1ar^C{Ao(v;uU%lI39Lf zVvI@znAN7X_ih6$I>vBhr;6f@EIvs36O$ahTP5U*~S6p(juuAXWz zwHln6BrYVaIHxYAmU|3JP(%m1p0u+=N7#A1X74x=zZbZ!)#X|0A+olnLJtY4uulMH zx4Sc^6O&>ec-jacsT9jL=O>hD$b(Oci_cmNy+d^#+U%3E8!GH!0vGrBHLVyRJb_AA z0GFNWROZTRYlRM)R*vgd_PtWQr<)CQJJTLovif%r05aZ@ z6l;`fl$G2NVqU}74!|oT97ZCdJ88k)hl^nPB?!YE7>>p*bPdOJB~>U_TzJLL4KLS-m+nsRXC%o54G($z%0T9*Is36V3HZ5OvgvIp@$ zm<2dKc3uV9Q(L^_#Wq6!qqqqi@ z>HGINr&^Wm7lL#h}oK$GFjf+m_v0?`jB{- zgT@4v)McK9CLuJ@rKP~AHKJz(!pV|yb9y%_e2hj}reh_aXgiQtSnIzhX#1+H)3 zfQ|Fub;tZEF3P`#@B%7!>8>5QJwQIYs2Uj`)r6O|lwo~e8ybI8UW4c>sO$Go;D5&l zsVmf1Yw$nAn@(G4258I)VI(mdmoHb?;S0^0rUMM1>eWIKSj4yV0Z{k!ZVn-bD%kml z-)|s7f<|3z!t-=dl3)DmF94B$G}S`w6S-R~VBq2}fnt3^Uvm(ZU?o;@wmnoy1MZ%O zk!{@^fys~=m4gqBcT2|z+Qyrp0Sttp9}fh$ZP z8(I~ZRUo3VujRE)o;Kz+Ks`m^VoL;p`~~v?@U%ENvH4SKZ%#`afr!5EF{5tQjj5IE z1W&aR%vA1UtR z?jrnH!~a@I>M@Iv4A{vsxjcj&)In6vUi-i=?tLfcU4J#*qBc3ZWdACTAu5@#-?OBxJllJ zbcwR09nCqsi8%GIs6jaNWjga(WeM`9eOEQKB zdI%d17K65@ERca9o#shX(1r5-J*Z11oIbC;RQ2o=0LsB2{z<#<_)v!zbrJ~${3T2k{kA0*fg=5g|L_V_m|o-N#-tf2YK?qU7Qfv#e)_DSktGBWojC zlR1Q>!KF^W*)b>K-$U0-oN(Lgcqmi{vMe=RJdePyTWo|J?V4OB?(hg;F$))xx^~jw zah0u8CJ!is|-0nr9#8 zirZ+OwkPRh{*1ffs(DM+ zzZ-Ov)s@Qa)8<9Isifbh0!v=ltKp^voCgkyT+=kqcTB9SHn@bL-R(-OBZAueozaPp z4FHTf5G0rAH6w3Ib`|_ekOzvvr6v(&J5{yIO1)J8psKE+p0LYk)Be!OAhvha3<6$i z?z~1O)u=k2X+alEfkiQ(rF)z&(j^Pt9p74~K_y=ivh8S{BGS(|mqz z=l@Foon>fy5`JFAME=y!qJNtNi=_)I;+J$?{egrJiib^!@*D}2R z&&{PPeObrY@guaQYsu)NsrTUrQ->}`9>=6a*2J{x6`fA03HbfbEuqf+D{n0W+7?8q z<-cW~v5qm=^n&oBfVzjN<~Vi!!xK|>_AYAi;XBY!e{|JS`jd7Wbf?g?J{jnVtXLv{ zS1c%-ZCB2T1o+J@)U9uEsAkVOYRk#4Uc?yu8rtE8yYvOlG>|+iTj?OL_;>lINALfU zb|m{d7_URb16|LQz!ULsN>(Gm#eJRP7mx$Ewk$2=LtBt%t0Bak1i^{w+(3n z*st;vDz*sl%lD<>Bp>$Z?vC*7=M45-PxQlSR zUFu8I23E8CGWAEZl~YWz`Y&ALGrVh)d{%~L0| z5ieLV&gsE)6YjijxL_GsW;sB6{Sc#jfH`jo%xIO=vnW4JYE?f!g?;?#A&?a8=y?8c z`{MUQwt$AqmeKnNx!8Y8glZAxdHuHb@saEhI`Ly$*vtrNh&-Fgv99%p!lrm6Us?fx za=|2b2X}KZz1A^Q0fLERCs2{1@z9Ml{09<_EEXO)b*QHeapAd@1qyHqOwiVyYPU># z!g%cYJ!#3=R@iZWA9=w%Y}8WlvFL;qMisdD3o+gokI_cPf)H$x{{wH!fCRoqp_rk_ zI%ckMic8LOu*Oa1$cNMFrKY;~_%X~-P(zPP26n|!g4U3T)@KH~hSuiNnO8NI|J%`!<+Ni7)X_k(28{*4?{`FGkKD;2II zK7Kg+kv&`-&=sK#rg%+~6OM#z1@1z%EzJ?jWGJt{Ta50^EClH}HAv1ZXkK{L%qkf} z6*s2W)Zf`Lz4Wp>eqy&&5O zP74fXPj?_U_EnR4Hg{5cvj0%k*Vaas|8Nn?G^SnBj?&~kkyu0?o4izv4IcXSJl~6A zh8X&A+dS?TRDp`6!3k*AvB(tH%8EDGCh8DByRLOTINEcP?5AM^XRJ%*2!ANL@%b** z6buiIm?T%y9*>r;BjkCUBK#aa38bu!KLR}RB&ASdr#^u|rf;tQteQD-(O|5f?0VoB zBCs$p7p;64R@+$)3F3J&K*@)7v6_lElM$WsGVFqt3pSMtYVX>fy{-A44MjMZ9zicp zjD(aW_eBl)=iVIAmCDV_BQ@dTva3Q^!>bxxvAkC)XnZ7B^`TPNm#V zV-rLUSbPu9k93XUEv4VHJF&2k`&nFyk8V><3>&Okk<$ezJ=@mRy;wFFZPQhR1FajT zw9}sxViE8Xek7~DKm11P@-kznn#GmxXWxfK-?&Yufz(cMcu4ICB(27Xnl1&3L#;E;fp44+@ctc5eUi!470==Yrou(9^~AV1ohziX>45G*}a_ zJ}i`>Yr$|If$xV*nzheY#;q_ophB_O#s*;mZvW5KVjgT*_OdbhWqLCGy@KYE4(nn1 zFQNrL(Ft{a?kR)98@+>+>HL<<<8w3XB@C!6Rep&pjyf~ZUjxxKPF&l!`)G#+RqQs~ zM8j_y-S`-hj|M-t6g0y}hV|;?`ZbOy!PPS5r7R~=vjLjl=^Jq=_u9)44YOzU1S!k5 z?{2oNEQ6qesg_ncm&`e*&BsTIh_Bojjd1hDd3m=v8Qp3`LjOH{aEotrI)V2>NsUlC z9)0@JENCi66f`TUgktk!A35?J+SHzSciy43Zal#q;FFmZW&++P$-xFPbCd$x=QcF~ zs(1vSk+WdfL^l@G_z*?G!SK15nu%@1S?!3|P3MOap`ij=!b%5PypA2B7I&bJT*-mQ z-?_h>uekIBE8tX!uuwp}e}e$s$v##R{9QYNfo{k?Yi+!JHGegQVzgRW?w9ij<{KP9Q+AA1e=&`C^2)K z$0{I2jN8t9ymIe0Ikh~^B!O`ckr{};I2iV0WvxRk+S{g9Ga9_}UBUTlJzD7|K_;${ zwXR2U8^uzhs^T^8T)o2B8Z2ZiGRcdWk-59eYz6sby0!!exe>cwd}>|oGYh8gWLhd( zL3Mkr_l|j!`vMMPsU)ZD62%Pc%yT6ph?7EADG2huugvvnOEM1B%Y+4E8&02ORu#dp zU^qH=(Qz#=Q6AaTb`&lihyt>457*Zc6gULfZ3aQQnrJS|Mu%qbvJ^a4?P$_*+m1RA zN8-x^x7$dLCNKrbR5aYtuxaMcf{5iulric2l!s83WP%h&z7n^Q!A^@Om=?Pe?SVY} z!urL9*@dw3YfW1m)j%(>)7QpnprZ5)%X}aqv`g;{-zViFLt9qO@rThAJiz_Ao(#O| zqRAsHbU{!c^~*&#!`Uq{(BKi`Ap$_OzVjWagf;je(*$UQWF=K@O}L2%TC$k*iu8|5 z7jP4QV1fK{G7IAqSE-IWwxC+d(R>@B(ByD+TP4xY>I{O=`NW$vY(vv1fmW8vrS~jm15VtQsx7U?|NI ztpB=9bN-B@LwRymS9EuK@{qYegcrC(?}PNioDMzJ^~|!;e`ot;cmOs>07h zps{Q}dRpKjV>09{mZu2kn!mzuK_dw4qb(kvAX{$krPd+{h?G@snyZmfc|g|MwWr7>Eolr_0T z)836Z-=Hc)n`|QbYQ&|Z_XMU=;pm!LD`)^7b*sinLr>mGU#i)cBo2)o&&@*p`|RL8 z;zYIXj;(2Y^L6h%LY#JE1!{sU zDmir3_dN2xp2e-yF^UN;<7X>Pvcf)iqx9zE24Me{^;t6%s*xb_*&IC_qWV!lt!h2q zgAV{6a$olONmZL}H?#okJ1?u}BzR?)&-LP6!@#R?co0u&y0)`@^J(qsHBvI_u#7WI z*Tjgjv+Yvq*z_Sky*liz|K;>JPKIrlkJ{ZGt}c2q1AmS|ijx16y#yOP+?im$nHrK?4s*ATSJi?8%FEZ&Q5tVCsCGDf4}_F zpm}h}mM_9P5|$*rtd3*D%ia63q1pBnk>ou;G`?}faaZG|GErjG%lo*@d0`MJ8#T48 zK93FTLsc+(ZShsn*>h0|=iHZ-9PulC=vFxQ(P9|&yQd(@otgTeo~DkqDLXmT`1UVi zfDuyM*H7mr9VZO)PDZ7yae4P(9};LPF2okweg+O@h*agq+37w%MZ?^54Mhf=)R2mLL zI%D#2%lqj~?F>=C2LEx#id=0XuPqh|VmfN%Hwts5>o-<&>o+>oC0nh;XE-j;gzWHJ z6;}bRJsVcu7gx9Ev*GUvH7?>x_kxw~V!WsN;cmwuJ<1`%q}ti&a9ks(?*isM=jN-H z4Sf=Z+W2QC=BbK7i@?i)K~j1RyOB_}PGQwwxDz37YenE+0XgoUjyP#DfEgNDxtMzP zyp_ks47M#|>giPCL_TK= zi6G2%5SAr@fBd5BIk};kH)iN|a@uFh8Z(`LlbMo7MSqzqwKIWy<&cwF4GIvS zd?5XgxCNx5)X?=SU;$$rc%tNd1%XEU&Yw-KFe`R7 zxxVBb^g1@1#Dq%Rd>zVx4Byjo>olG(D|iVv@A zG-Ofx9;FQIXs*!ZzW*qd#I)N-#Oii&rZZHX0J^ItZMD=eB>gl=DDj)4dEsI+HX^e? znhw8lE>i~EF$m0ec>}MY_^(FtY!+pjS<#dZ|NdUlVlAlwRqfb-kMN;BVTx57B|-SI z`Qk;I_K%hLlFXLETtNU@`AxE6e}YqnAeogaDS@bl7+Q#05DY$Z?q|K)jD7C-JYwdf zUzblaUogwTN6w>glCh4ZWD@02SD7j5jMr&fsum{r1O>6i(u(6I^5Q~e!7>9H|NJ;3 z^g7(Ym2j7bXTaSQQ!D>-gSB2)?+U}_(@JU8$}qDk#l>zPahPt$Y~?aQ?r<(hRQI=W4Lntm@1r!D9loV8YQEmUy@luHcj1z(`SE9eXP7gwqa=eP6i5NJ-p-@IM8j9$&{ zO?P9bMVmJoIU;n~f%Nj?8~_wD`cKnV1Q6V4bVvlBZ63kp@Fu?k-ez)LJ7gj&9#EMQ zXrHR>+D8F8-^$_3>+sOw=5cZ<52D_kB}Dea0UBh;9%o{`Avx^+{VPs z)d88oW6=8HsStysx}uy1qr_m)JIf5v!-!-(!jcWPtr16n)Q+9QU7b9TFB1$O*E`|? z%^gbqXxwyO7hB5rlS~chSeCkW+LZSq+W%%RSz_n0!K0ceLcvVXUCxBY9r7b1s6R7N zEw>9H=|_l|GWZh~5Zas#;mx8rEj|Uk8-wwAjg_7<-g$j~$lV~A^~%$9cv)l4XklOs zROkRKAtpOY^5;ce@6G-{SBvP(RA;2CCfMri2c{Ok%Dy_)4vyyjTR_l_ct0-zaKJ{? z8VEcnUMJjQN(bm$g&&OC`=5AQU9V_H93hjkClC;WRhit^l~=CTn$=|jVr>PCf;X@s zY75jD^eR|VXTPZ2!#5d<@02%$5YJnfc#=Ua8s8>KngO$LH{wb~)GkZ}0$&EfVb7vzG%KM2td zC84yOhA=udT^*~y9)Xt*ZIr|)^pnjhKH8w#;h;OS&|8AQQ|IdF+8 zKM&O|R%{YoBlhLaQ8UgJZ?fL*O|uiXxdDc|)%EI-5Eyf%Up+DBx`sRdEQRE3{kJjM zootic<7bz^2D1=+Clif1&Ju5CaNRNM-zVp7I@F4;qFX zne`_b7#fSI<9vey+M7DUxlF5n_O8S{%6k%po{tQe8v+fY$>(8uJsA~Gz7AX(=~$8H z(N+dM$D*Xs8WOwCA+LB(Ty`!=&{=0QfeX)`r99LsvIB^{?TeoQ+2Vc82+457+|_ax zRoTTPBV)V@PKQIZ)!D`bJj6P4f*u>(Drt2g=hxL zzmWRo_z1C7HzX5wSvZM9)6+T$FP%E5!x&6XlIqURQH40y@84<|s}dILnO64B;{*?k z)lph{S2X_f^SfKzciH`-E5m1&K$y?>TnbJf=yFbp&#|q3p5kU*bO8N3YEMWUc_6*+ zB$&vgdP0FD;;Fl{49(Jup}A~is{AZZ)Rs|Y0Y;BN)75!8>Xd%j7z5dVuO+gzje@p99td2 zMU&>H;M+<>!SGmaJtE$fG(q9b!(hAm2eGU27`!ke#w|nrE!h4hjD4G@RKnv8bILiC zKd)R)vZHsD9pK`D%KBoW`soY{4deA`>Vf9@4c{}1X_3CIr`U|ZY3MoR=9^S1AdIMG zqRHUk(%|3qLeX*+4}Ij8HY(6k4$rP)Wr&y1g6W15%crfroxx9|Vt#{r=4dFn=P_>& z*nqpYf2fC!Zm<*eEG0+zMe4bYZ6*KNIYCE;N6?<-6R2rLrc++CCKmy~*J z$bC_2fQ^6u2m?haLb)O0L7^k`PAea30~F_})^j&*++S}LJB;W#mzEnz62~I-7aFUi{6Cg*n9}C<$qG^ZbRwAX(?d`5sVOSVTLCPd(^C zN>$nsFM)<-0V&7Z)H-_2sjR$3xPY*z&Vt72Oq}M4kKDDN9EMP~;W+&28(SLxH+QwC zifl~mvr%TU+kWF9_kNAEs`ti5R5}I~9J#!pZ7cNa(-IfZ^uQOmYZnsZZ@o;CI_7Xc$!YFX`viCeTD6TfOfWWoA}2r_Ka{eIZ?5+D6(bWYzK zDMZ!M5*ibVDwP2lwm)$NKUZdr1kghhaGsG=_0obM5}7@>?MEWCzNxoNQ*))lvJU ze-f&ixD!ng5ze~Re^hy0dk3r;h`s~NF8<+|Emg4TXzU41#Y}_ID_j z0o!~w(GQ42FB1L77JK5fXl;S15BfOn>#@}=2cgO8I&IVSY9jJ4h=hp~ z<;gG|%W$mFc^6WGfUD&#D%&pJ=l|3h^$7;}Lz@O+L>xQwA=H84K~eZG#?;O#t}iXoPDV%r~~ ze$KnRGtA|QW)dm)a%1}womizj?-4O?v;3b?H5)NWh#^wv;Cu0A?FVZ9i*Q6u3({?T zPfSU$0zey(@wLT}SL;zr0KLhLKEf~hbQ!^u+*-g4-Llk3Lia7JL(N)H*v96Kwt9?! zO;3qgB3vKlXBq7$lK@Hg)cC?U-m;~6H7vAK$b4q3(@cpHm6(hj+!~QQwnf{)$=old zw#{Knxn2@B3o655dW_Fsl<*+Gn*S>Sjeyorep;Usigh_H%S51B-zz~hv{@tZ4H0C= z#(G%va%Tga(8vzJoCV*RM?LTdt#TLLc$UV zLWa#maP#sz`-f1t`17TIEa5R5(*X~qQp)D}oz|j0S7)F_w>0w)i|B3X3!~Ykn?i6{ zZLnr&J)@Y=%+Q3z*r*wclP8P3@=wQ7UrK*!XyIbrHB`uQ=>6~_9pWr$@mN@dnK=5P zOxsx?7ZN}fM36LAJ%Fgj?)4~O;CkikDC{#=Jk{zH%gNu(BNJGvn|L0%jfw{$x?_g5 zhcszn@CQE?x5H)>>vaic&ioKD*fd}!5)KK{?B7K;umFDc#nSEhNk4qL5)ahmuYWQAg=5f5w!`h(Fv zW>M>uvwLmJqm0U86QVUSQW=De?;>zh)9$U)j_$y_23v`%%a*CkP+?B;ttP1gIy*znOAe?a=14Hn_r$$^RWw` z3lrrNvkkC&y<1}Qb=Cm}c63>QJ8J;hLg2GNYe9DIom1qp#M6xSa_x`u;bzh4-Z?%1*x+I$O$^mUgW>*|C#`}8Va1BR^I#RKUV32DTYk%mjD z?@{KQ`H&W6h5Pqqd4#LkbEVYf?A^dk&SmCsQ<4HWWRh))8~;V_}3Cb z22lE7W_&!IH^+ygCVr}&o&aKFu62&)oNwbH!YasGWY;=xh5nV|>EJb7_i0%-q(d5& zsRs!)$!3AFg4m~ZP!~d)NQ6Y{E2{x17}j5mjYV55g5f zYnwdH;4sBgL&A_&+6@dZr5*|F5)-~BQ(CbXerXOn@!WSXV0{yoXYS}y>DrvAxKzl{ zX%b}!+=rphC$FK&$He@Uz3!l2ryGd7X224DiO`U6`69dI$t}&p{!rg!EGuv%=hp9n zFKPqVVuaza`IQA!5yPb-O%a!==}j*6+ZNL4WA9?zx#(D@_W2Q*R*>-Tp1A))i!&{l z?IUMz@m|~oJwatGFF8j$T#lh;e8rm&D!&<6YH5kO!`rtx7V$71+~GVOJdSSYO!dy8 zSGIte7?gh3EK1c6*q0*`s2K}L(Nes_8ZUwyZN24+Zt+xRdyJJFzDk7 zyytVzo`rx5aNcjS&|-mQ=AiBLm=H0QINOe6f#@y=Q{M$Zb^*&~9^kSf^cmL_QHomc zJ7H!8YKfp}!`nQ8*Zj1HTq}$Es=~In@1CH_V>WRfK^wSjYgtr)z895kkm+F>X`^uc z;_h{dq*!hi1$b`g>BA*hEnC`Ch_R53x>?KrM@SMiZeZR9`(@*QsuUCPI=hnJR9Ru1 zsLyMhfa7!Wfr_3*qgf7PKTFj(3TvcQU{v(4pQdGePLaZ|P#1ueX+^E0mvw6_r`*2y z+hkMTpO%reqlo8rEtoumMYyR`x95TseYL1m_pdJH)i3UHdCnLv=BqGuYU2*#`|3Ub zazNuE^2weLCSs>*DfBnrk9*=0x$xr@GWX=*rK9%YZ~ONp!5szeJD|}tPBl-aX`ToW z?bmF-r#Wv4nB3g}I=5rxa{m&;6<#jfWjr3aY1nYEEf~DLrxq-9h@;-pVe-!qzz6q$ z`e}{UV3WZKxpNldjTAbQRl-k5b!2jb?%;Zd;tJ454``8NIa>0FS*Ch zt>19egXDAQxhVxvwUKPejsfC|ZkK)E{8|<~0`q{vFR~|r4g>w7s1xHxJ9%l3v+2E~ z`~>nKQp7ADQq@tIDm8+0moRs;29;6`^+tLuyg4)4QQ!WTg{qR5(U-fD{_I?hQ?y9D zFl;_o)o-6Gp1aA;!*(yXHqs?gsCw_f3c+brqLdT>M!t#6@Ef|ZkCVSb`DZEAc1uu% zVW0tJqG4A3ai7?GfyfllR}>Y&l*`7B``0lBCfo-_mp4mUaTp<~^Me|I z%4x=^HLvIUq@m&wkv0?klb|&sJ#+lgeDUQ{IS60cV%DRav>b>Jd^!GO**(lcq(kbx zfJXHCrFb5SOS@@x>Qta2mZI#e#tT0LeeGXkGPc{n%MNy#5C))L0YnSYTM);HAn4QF zXqO^eYYVng*K)31X9K?5w-Z)1KphA4+qNi#FgHlMW`%rUda&D{vDL(floDt%IbkBI z*z}I89fDtfZLejvpEak}3o>n+3v~{z_fu9$axjFLj>Cvvc$aX;trqGUKDA9w$Z2zY z^;lm~u%9WpSgc;LFz~e2>(m3@)A$63Envs=kE8DNWV~Ey=tu?qZ=`+b-BAuY+s z>_enhEw;|qFdv-Au@AN!B zE5`LoO!JeG$`gl>M=GhQPE9rsNk;7m3*Ofd_+qht5nmPiiuE-@)h5d!tkGI!I=m7he?OJg)?I^ zDhz_JU2wpV_}AXC>^5k*V}A^q96nbu3y1RAM(JWB`~(*N;5c934*sf0dwL&6N4jGG6W%_eDz+sqPbGbdl`RQ3MOnRSfP)x zrMUKevW#33XW%vCr1&q8dfO0R8JcQI`08Q35*lC?&*5yAg!M3_j!PibRF3yZgGEt;KSdN~G*r{5|6YAlsW(5+XVjHmYF?UKCpBnyrh_V$DxbKx?Kb zvB3hs7KCxY=xASf%bu2P=yNYh&>*MFjOx8So=aNt&rUH<^cV$p*HW;C+t)7(osVaTE=3yOp z9iPe8a0VOl-#`55xMY(CL5MSld#?nQ=*{rf>yCE~&424jGfGt%H#ARg{k$9o_XkrI zGVl+wDz@Cw%|Q%RY0ero@H-BffTLCOP2Rj6Xzr7ztrs$QzIIqsn8cQPV%>UD_zE_u zIAwLh(J%hB$y9~0DJ9&{Ap!g#i6T~AXtW$G3rgh1g3ZnH9cbP9H=C!E7a zQz{wT7{43hT`B8SD09GHbg5=6P=eQr!{3xOi%XqICTsOFh2Y=yXRi%h3IDD`++qRL zptzG^>#qx1z*55apW0!2WOvJvHTYWjF{y<(Hr>DUw+x8b15f3+W+Aec$*OwoaRSXn zSDxWjFzccm8`+H~Y0h{jC}e+TRF4v0y(j)K!x0WQg(FwH;0A;$eRVT(#Pob*=)nW2 zWIdPMLMvaao$#l*i~6Fo-UkTcvA20O*g(G+8A}p(hrMJX=+9bB$|2L=#3IHsvnCQU z;m3XFkRLRDhw?^LoLAuZt%bZtcR zN}au?3N3hc+<&{vJ5|xRGHEb$VWzH($8-qkEVkqM*-@qWRF;-W;1wm+9K&0^wsMsR zj3!I6FG#~bPP$+dU@ zJ1Qll_T?*l*oF`B!?gznHYBN07FV)fYwqN$->(2KL2uYmOA37g-uuU5HJa_~=2_G} zSDs1C5KtY0d{Z)sRvo|fu^;a!T*Y8FL}fC&=!?Ff>T$hEjfc8C&0S=9w|^o|&;`UE zj0;B}YcOdo)5Gfta)iTB{!LK z?ao^+0pma*1Hojb6h@&;hnT;Ei6(WA(w>?RrUy}IDF*%-uk-&ZCm24ru-h;7JO+Y%ssiD2PtsmpbeKeg3>u#t8-guUq|95LQiJd9-Ne?W)I` z(SmF*F7+X;PyB%?+-tl!#l$jfQGG}*FfJpI$RCl@6CN$<^ykHDEYq;t)RjuIg*K5gPuON2bGJT^7LH1B)V?0WqGRp2`yY3=v^@oKPj}^zD49Jg^=4~8y9xsg zz}(;bxyAT_o`wXip8%;2*LIMdjtq`KtNtrZBJGu2B@}XRQy4pd!l7RvN@5O z-;S#-7$)IrCGZVDnO2wuE{LR7Acu+XGR_XM!#4dkjc0iKA3D0yRS;nAUcy3dkua+6 zU*lR8xI*B*JCu8g!-$Q6mA}p7?BNqq4wF3m8iZffS|ECHXteDRQ_)F;D2?2phOS2 z!N&#ttm&o|7y+Lw08& zI%67U>xKK?9&Bk}n8b(a7}K6BU`ZA&)}gS87b7p8W&%DF4S_mRsSYltS|)sOzWzA` zV!$m66O-8PHrky#IAEydLeltxZ?~*!h!*7r(akx8gcH>iiwxdw$soJL&pvUs=BkuY zqH|ql3`i`NY*?u082zX;BLswnl<0_JRRzTY=&0iMOjw~@osQ7Z$XX*F!NN6V`aiTE|{2H=5 zU(b6;4&umb6z}0_0k!H4TxxhazpoIk1p-s2J8~sLmD(mIjNRREpQKG zdL8+h9)4(t_zU58qufI^YZ6AxoyB%ahqTRF5yaz;?jK><@rL2~rC3^LXo>ImEJ^Va zH2VDxQig7Ubn*bFPf}^CVstWSVkExcqH}2-bm;ub31CvAXzlGBe1 zYn&8>+7fZv*Sn_6TM{q8xtF zE7Itj>1MlfO*9FZ6nj@?1Sbl+ZynYK9xY6pLqR~1GPChY>*QW+xuQhMI~)>2{)%Q( znEo!ccnVVllIU}Go*pOt-?wxI=gm*u%tk>1_r$Xl&`3&EoKXBzc_#R^ZG7a>-5P_? zGuz3T2QK?8x+{lo|FxBVkr;w*D9#JnG&?rX9?$YWIc0a&Fh#g5M(%RKhOj>X5~=lg zUcds0_m3>Lp$tDR(sGQ%r*W#*hMNw+J}G=k{{mXx$#S2$oWqEEUoXG%8T9fzSqWYv zHxYudBf6vH^UVQTP3PV=@MFI}%+u=T8Hr3Hc1l0>hn2Yb41WIKbdF0gSSk0-{qQa{njQSZLg$E5bj4jQ(;5xHcnl|>QDHNK%av;UMGWg>yZ=CQEdIKPi%0a zUqP7*J*yN9%TO?@pP;gyg9*bX;u;A4>D2`u{Ubamh*b;ESX@Rc_2VkyRe%57uP%FA zmSm-r-Rfx5yS)q(U?D^?wcTfk)WeAG6r%487OF(i^=0_c%qKS{90&sg?9XxA{QQRM zSEL%s@(EbqSDyDFJD0?0ld&kmvCMBk*XEFNBi7Z_KPS5Fpp$vBAIt>nMPKEjt*QUJIhhVy7 z_1cYIp2RC3YMgur79cr&Kr)xGLVDm7|+ z41>Z{w$TmNn|mHy$DKFW>G4X6JRG#Gn;h4ztBKlUi%0%fX`r^xbo6)zaOk%GJG*p( zcS+`-`&XVFPhGjR`m8%z9OdbYdsk008; z1|z314;$5q8D)8_GaK@6q0(+ABm@P>L%c9c`!F39r_F(Ll9@+|TKuKHk&4eBHe$x0 zCc;ev-D;ZXlLG&Y+>eB_1k?Qv#cF8bhO7j9_ZDYw$u;z2@r6)Zu3ZgQu~OsR?E2~yJ~c- zyzuTMrSeN>YXgNsM~Jr2eB!VLNZ7(@Tn^4dJrCs(&!8iIf+RhJ`&7y8mlrmAT0r98 z>pUj!-{-=X@gJVRp1GH064JF-6{uHfVQZ29W$ig=FmfHZ@HLlyY$=qPwt_HfdVQhM zz8O*Id)ThIv{NBz^PAK+y_Lc$)JL<6oRJGdV>vPdRex%6rc@wi?w(#+D?JV&g7nRr zej(ha_qwv5|I0Pxi#NpHismFDR-j?L^8DpJY4AT}jgov>p{aYQe#zN!E%FAe@vA!y zK=`|q%OV3DEZZ!?aNZfOBAnD#V}WLRyur85BG$tM6E%KojHuK^yz~8uGci|GV7|a| zJdQ&nnGxFQf%W-i&P}|vakI<~{`0y1eVBKwbYN?0(F7j|Y#=lB&j;AUvS1w|qq&WS zEq|&_Y~yV5q+<#S_=8?@w`&!e4G6aPQ>rxmD)<301NZFM!aHxXWLFvI4fapRf6b&+ z`W&LtP)!^VjMr}gEAM^Z7RK1^3B=VE z91zxc&%1MdTczVk&qgQ%RSzr4Sx^vxr*}F^vvG&fMkPtt7*vfGeZi3U8AeQl+slL9 zDA`?e{11vdn_Q2>*}<)?;Zt4E4k#=$8qx{jJNAJS6ZnsSeXtxwZod_DLq}yyy^vpy_wl}(xHy{$yz)7%!| zL`4pOU>-gF&`;Zu z0Ual^9O6fV5WNILVnQ&b5Hp*v$9*{tkrrNnAVLkd&%D6RGv5Ah9fYs|}ZlrCXy zQyIGyFq_ye?f6Nzk2=2Z+35t@4nHO?k%s`FslJmE!!wg@4Juv42aUb1Ja9oeTs?H! zrHyTOCggU%*>Ib6Py@O2z#rpkj>+wHK!1%u#w&C%KON=+>F9c5lv`GLO5;%OA+BS$ z2p1)MZcbK>ofu?a?98cySHFp)z}Ez{%O@BfoyBpcl`Ux4@)9ugedRXPnL?1a9nv7~ zjz21CIv+HEnEE&+;V9CUh@-h!LxNTTyP_F_Wt@a&14<`v7kcV6EFY5}IH-G1-Up)i zngg}CdUm+byD}iiUh_ODC0j=D<=C}g$Jr4LX{MD%L-h$ekO5SlaJ^#r9w_%A?cPWw5GHW-*WoGY3bjbN=*3k*a`Ynwu zMAm>0_hOG^a`#a6f+RmynH9=Rqtm=IF`wA0U|Q0+a`^1HkIPQR@6)>t*3rM^bWVp) zSc*+JX&T5m+(Ka6VQr}9Vc>NKH%J3CulYaDksA%1TddFN;o@bbMp0*%r93|d#r4s~ zl{0LBqv`Vt?B*UDI+aZeN=o>zn!Yd{UzS6^a_OblKOOofY=14(4VQR&eWRf?&YpMV z1_5ut1HkYG>?wGlV}h$vhT0?Vq6Unk-W_RY5=M`#Ylms0dWR$ICC(qJ@!eFj+8+Ts z#j^%k@cgtk{1f(kC^YfIu-l>N$NdMzjz%L$yv$* zx)F%>{J^$k<^jnc29T3rnc1{VN}LKmwIii1$g5JEB&c>%VwCv(tf=K<&^Pd@U?Gbi z=(wr9C76o)(9ifr%GG64Eyp7r`qP$XgFY;Vq^c!&5?V;VNlGnr(^pSckrP<;I!2CFZHrvQ%pONzbUc z>?if6`{EY1e0(CQZKVhn-s3$Zk+IF8PYxn#CO!lk<0Vgu>tMY`?zXzjkNSqqVALq2 z<|#RliFcH*`Kz_08_}!f-7Rkk@iDt@$xw6i4#l0=P)feYACQ0>XF}0r3P?6Jx4#mIGijsuTiq#s z>|N{en5)44Zb;d2hLAy*%%!6r<)pY@u-WW3sO*E!OcCBWYI5ik1_kSp)S7X`Rx0tt zP`EKv_2k{1P&p}L1Wj=evmh>8Vy$sAgqwpYxPH1Zx4z&8sN5i^;WN?K{*W~ZH(@o< z7PXwAW)_ZU^8KY3C0Q{4gU-S)l?Fo4KJHw=>gY>QX8(K?6gaAk9(Z%^4 z+r>^ez8x#iV47Y!^dNuP1 zP@(ovVKm19*?z_qL$NPpv;cZV!U&=Cpl$SAOYa`Nj}X-!+8o~n?8FW`B8T)A`%GsI zI=35XXqTWX3o_Ib5H;9i65mbVgtGTVyCrO!O#W?*XX-?%sPL7dCM|J;BMrGU@GI~D zbT<#af>OAId%!{6Q@>s7VpB!&$B~TTi<+F%6s3S=r!rrYG8tHcp$(Eo=)f|BXN+D7D(xk$ffdfQhY~&t2E0zL z8l?lv&BeCnQ2FV~Y_jU*UvZh1Eo?GDux{LlVtpItzaY>GcSS!9yRrEflT1E_+F!>% z)Xu1-H6S_`w2ro)HyTaxdW?ph>r6bY3%5)is(?PXCGgvv08>L=_tzn^ohy{k<}kib z5lYZq5lh0hx2mS>XZi)E=fxA)gz$E){Plg!(Xy*76nIJ+;!$$ij=RkYt-d7CxPM@! z#0K6Ok7M#%*~MV)T=wDqXYzqrZ4Mf!zj2U_pks`TAB6}2MHI+TGA-jBR+KcKGx`La z;I7Iv>WC3E#ug!7F3dnb6rDk>D#AjhVM+7H!J-2NRwQiWejs-B^-H5fowX>F3TKm{ zdyV{AuzVO(-_6;QZ9LPTYqwKjPXr;#W8`qY?eIsJ16GgOUP+FKtqEUFC7Ho#+H@rNsA{S zYlWuJzYxQJE#(KDBVIA{6DO?UurH)8E%QL^{pRW-rHbXr2y-2O78HmB@+7Fk~92m z(aA*uZ;O8=h7>VDJK=`?ZIh|CO8oiafYmcE4Q4b zduhW|SLbtf30|m(r>sA!dngsyI4##g-XGmC+`s&{j&{B!2J8QzX{L{R{8bi57unNv zQa+IBtpLrV#FaqseCX(-_mE0PyTs>Z8R5e?chr}Lk}!u*=kNtYaE)6%vili#tFJ&G z=AEeE&12otdX=Hj&yeE8qVMDpfEJ=<t$LgX> z3(x+n6~>?$d*z2Dv04(Y7}g0YGyaJJ>S697=JUQKljH|?8J^|!2Z%k&J1N++85pCi z?IeoaTPpY|`#Enc)7*yK9eC~}_+y=B%e3rdKnPOpj*pIi4F=84?!&PL#04At;$ZV1 zfrHi)&K!UChi-l);qHCC%6!&Ycc&7|x&scRFQcRCj@n#!?@w-%xkjK(x@uFUwNM^3 z8C%qPWo2<}*RdBpqCZA`4<1aO8E(aIPxqvh$6WEl2Po^&u)FL?g-t?5I`R13>(S?03Xn)|Ll}LvUlp=3lmfA86HHXPGP=}8YoTc3 z%L#qL;G9^w*_M5YwdBX(F1<`>6$nyV@x_P;CN6}P9b$O_I~?{8v-g}v5=QfW=xj!! zQ_C4av$)9Sx?`^uxh`;FnwA!NX;F=3S=iN-xgmRz6cED!@@~s`u7VQO5zzlb1rgRY zbAr9yD1B-P>|kt297dB@kFyYOI_`k{P_Cn&e6KQKX9umuudDT{ z$;=kc#)+)Ss&<4zPFdLC6(z|JeS!Mp1_vm}_O<@o;OJc|TKcr0Ix8B>N2hK@OsggV zf^3W^7;k_C%z%tlkN^iVVD}7#6M$=41WAx25TbMPg#a|pU}K%IQlML;wGggH^2r(ZkD|+WViV~dd<1| zX14avnsBGSR+HtLk;*pHz( zP~3+|mA4vRx_iPH^*Ey1--$0=PX(mzvnGN>xvMsGd$_n9AhnPev)h43VsuN)s#{Cv zP>ykw+em29r=$Mpx}b?`CZ%=mc8RQZ_z;=D2^~bNI4@%SzaVCe8jZ7XGY%ews+@CJ zRZ{7`%Qp1+Z4yG%xcMhjdZrCA!^J^?4p+5jiR19^4baE52AU$yXL5%|3a1@O?j}xl zq)M0nQA^uR-^jW+fh7DeK^vR?T!}dGjCGef3Fo^ z<+s*9IaLSOitnt%Nvt-Mwy@vq@yu(u%rR}h$h}zrSZSFec^Bo1@Ev5C!Ry>+xMgSK!KX-Jq{?bLJh?CblBjMXdVTT3OD}`@E znNvizt{=0;9bQTkRrZQNf?_O|iP-;5p1iF2hQHj;>1VXJmj&nQzQm)ngc7GH8Vc19 zH1L!{>Xew(NIgt7^u=)!h+VH z?R%jVkKd8_A_|@suzW4LnQ?tj-=sT0CTl-t&4Vj4JKQ)g#J zRpUdbNkx)|PL^(j1L)sVw;N-I+y+%|zT!N#6yaruWlGRSN?}O*Eu5WpXj?6zIC4{8 z`@DLog9g#NlTfIKAm+AC{GI&_80uX_i*e*^(wLbK1}U|qL34u|fL&{eE{HZgTUko5 zMkvUnz;t9^9wxsr^ZmOvJ95DbFgl;Kl32H{~HvSn0Uun_wi0P>fb29l+j%$o z%aV6HFC*YteMOICgv$J7wqx6Vl7Rn*hnIY!#Q(xJo;>%-om0$G`kfOpg;P)9z1c%7 zAS<$_SlPOcbZu|Sij-n-%)p2}Ms#6?s>DNI`tGs|%sy3X(!EXVQQ0*%29`+s!|8Z7Z3!U`uoEWA@;Y9*LEcC>!<9SHsDB9R!r8srk2r zrtQdF;At#!&`-NyhuC)R3}AOC!C-5KC7Y?zX$p_F>8%2_*qsxyu5w6t<)T22-KD0HDw~&2__BIU-e`^Djv<3FjagTeqk+Ks2Ku1N8 z1^qz-nqav0ZMo2GRC{Ap(esd&-VhdPbchOn&Go$| z=g=d9fQVl!;wNG2gkO=**Ft@d{eMm2-N5XtjU35P8dX@!cch7tzhS3`l<~}T%*PN81!K}iPaxmagtWY<)oJasYYhU1F@91toJqx)1gdgNvX;#RVMKeb zE)Qmibr;*w?pav|cgg}7Y(lKMB5&;aYNFM`dX{s)2^Mop~U4S^Ts+ zxxtq)Ieoq9BAh_sk98=azH;)D;*S`B9$)44$1LCBw$S_gGnB`Yx5mu zisUkb*_}8xhy@~ zXO$fk&~@2KTOs8I<(Ln@Zr9W!Q%kZhPC<&ww1q>H^w@8-74Z#cg}L(2bHLe>Q2PA2 z8?M)dU}Ot_eZUc|1BQom;E6jo5oiG!S3T|q!Edz_-RhwZp8wqdO80UVlf?#vKx#Qc zYmVk!?%+4CICZ`IYbBHV!kwIia9mZ;qG=^t>eE5up83mcqMrtAa%VanApRY_wqURe zYrd4WHz|1bA00!oPH_pk2J74=t_+K3=zRaBm)G zfLf^vSkuwV@JZ*sFHIE?f@bf>8fnuZ zl*rIq+^Gg9-)~_g``A^2hVKV9xpOGUmPxxiV^g1zJ{r$`5f*-4 zh*jFm9|>ri1Ke<5d3ka2$$tl^Q(TTH^@>B2Xt(vFj`N=@XLbT!Plw>5{sCpyD0%BP zI=+J6X1(BP`Q`4ZnJ8hO-$G6SVUu^pKkE#w!1z(J5m7ZH&D6rgA`Wb0Z~}VLjIFY} zw}cuz$bYfmfyK&iD5bI!7JwOkRU>cTf5&OH#pIiY7AWquAB320xGrXbBO>IalFRts ze4qsR>gJXPH{Qt5=o!6whm_W8Oo5s>n(mp=?1f)o@+EZG5m-HuY$^O+K$rIC+rfr; zKXWT6(QS?cM*pJ*j;oN?i1KLY?o)KUEH{9=YBThKKjw%ztkvhY@iWF(N{$(V^3G`d zARyj@F$Md}iid{ob2jQsZ?@yN8T2SBM;A3v6;;DFPJ8Q9y9T^NBUb{}njq7e3Y8wA z1J15+ik($-xSwrT5e#)dyg#AXA1u~8)-*k!!GCd00ssI@A3Q{UXvK6utE!75;L6wq zbeqTCtvj#_?JnX{F}}Fqv@SOiRn;Qko1OJA?Gj-3iz?shTo=t9Kp>zh z`iJ=DR)mwT0w1Q!)bvfkUe%gnZA{Fsi?~*xcbe&@seK8U-<%wh@B(&Py4Bf6U9tc# z%cCjN)`t=Tq&*AytN#}H_2|vCW;u$r#dxj#YEB8^#D?d!#Pg#;XoN+wnOkEis}r;9 zJ${lfb|wksO3}(S3I`O@P_H9zxYYm5EP;gT{`(POUUO6?9e z$?*uv6?N_YKb7m|Q0=^k$aGM8~EMbEki`M=a@IMNLJR;IBmW8 zViSNTBUs}IOhAnm8m>t5$eqA!}|yw^U^!QOVPiZOqkC24#R zQ6%Wh0ui2+m`k|{$Uj2&Hn+k&l>8vwkJ&ig=I%HYQJnENeTq1TC%&fDd$Apug06fR z|KfT>8-S|u-~v^A%3i-_C^8K0PS6*Xdvn?>a-JwF@s@$`*Ux;@6$gu}^%;7X(Uk9N zV8Wlal+$7gczCA756R%E7qwlj*d0*l zZ@QE<_1Ni?RGI1cc2oxB=VU~9f8RMbOm*@cgfm7W-8E&hLh2Z&+4XdNUBP9TZ(i8? zU4m;)i%(}G_p@i5*^cJyQF;3(XAOTmT66faeDG}9&3YHCWj!Wm{LP-I-$j!?pJ^4n zP>ho!y&m3wh1xT_GfL_#Iq8CCdARTVh<1JJC9-CNP;_FF*X2)BJT$=4-YlVUmSZxZ zVCl@Y8le^s_3=E(xUJMuU%awD07CUa$xlhuEt~z^!uBus>E{wkGBaSBP}ZrWPD8M} z*BPRMg$#s0jp?nRZUqPHXXe<|MO)9?!RuwLo8{4uOI&ag%V}^qYjK>rf6wL4??*&v z_49wPloga{ENF|k#+=*MQ&^1nlmN$Nel}dGb#u!vDmt{u#qPyK^gN7qp-_F!XOvXo;Q3Z#Iwh`^#jwIxG|I6p&x6yLX|+NJ!SIr=-mx+)7ge?{!K!4!z(yn zJMn4^i}#}Z;Z0lAQ%8yQv7;Ob_~kQ0YUKVcD~p1xk7B-GU%MNZ7uv&aH*g>M|67}Q z6SUeWHZP)$UK$A2fcq|xA*HG91R{*E zm3BeerImrF8BZIf`4@Q)|9~`pG1sJj$AK;Kmy0T~q?0l0ABIu)j`PVguOK3AfFW=p zhZouY>Cj9BGu3U-F0W0OB$LIYHr1^*ob+ekk24l~)_b(lrdb=h_iW0?CmJ^Ss14Lo zB}0g7SUo5dc9d|`nic`ysH5}K9&|)0cG`Bt794Q0GKWX@a4Wwq$ZDFuK#3J58#htC#Q`+n6A zGBK|OD|)1aJCVa7YNKkm%NfGc+U6ZX1m!NsuDtHXkyL0!&cAeF2!#^GkbESRdULCM zr;A{e6N~n+; z?#)6Kk)qfqx*wJL6mP*>azqNy}S%=Z0l{=q89 z$qn?7A}zMAlzag?meH zka4eH4k|UlN+&+;qEJ+Ebj(qe@fC9<)n4)36B}%f@76YM#!|BZ0BSAOu^r)lQQhegHC|dL-LkOY#DAm-8#LR!-KQA3F?mVS z`JrsE-PT;UEcIQ%`~6ZTe?lz*j*@dKhygOwGqP*ys|Z9eMt1D+Ur$STzE_HW#bAuB zAae>1>Ji1G6zI`Sl(V}7!2CpL24H4->dr)sK?^bB?O=M(-uzO>I_V1yD7s1}QL1FY zEnXI)E>SK^^#ZfoG4r32rFoNN!S95f;)7CahH|7P=jyxbFRBgTbr_Dxre`9K$-ydc z#7#Sg5srRrN$9E9pByikmF#YPSlaIi3oRR0EgL$X5(O)bG;7j+DCyz0G2zTdKR>!AM1BoF_+qT26Wks;0TJ%fwE%vOB3*<#JVush;L z^mH-H*N<-Fov4q^0lc$liz3E$%gI86&p9Zml`vFXZ#pYr}aJCc}sguG90Z1aJHYG*y~Cm^fQh{X|F%vXH9h@&yez7ifO&iOJ)|D{#i`9FG*B*z}_bJ^p-##VlxP+Kxw+ zIr@7+3ZZol70>HLJ9x=7uU9xinXBv|oX-r*raLOD8Y_k=^_LrK5JAr0uuMKUZtPsH zv)Hrpi9f@=$hy;91Wx3ak6Zdl@cBzYeNedC-w{t1EL4)9LL}66cs^*?61pZoP2cnZ z^uP=wO1=?y6L{@X<9#&I>t@)t24h zjY@P1&jYlnXp^;T$aailY)cs5kHJ@ZF&e+&xkL2|{O!)pw_v5qzUz1PSXO4!<0SNh z|8$ z+>JHyw-2v86`+;P!7u#J$m;C0W-*06c5L)beZ`VsRfs>>2j$8!+|Dt_QWn9L_0^9b z;-s1u^nf38=)Ptc$aN1>c?qjxF*Kc-gOIi@-gLjq$G$U9iW(E*8%r6d=iJ2XWS>b$ zVD%Hdo1YHh&W?~XZeh4C@T&M}Ic@9!*c}|sl;~D&qDU^&a)`tcJkl`XvTNKr%(<7H zWM*a{`nXk6z0v2+(_5NFX-vya*V!1T|6CBIF(#OvCxg}0mPj!4!v>4|@khYaaMcMY zm7VzsxfZ3N|MJ4p#)oq&Iscr%PRrUQc1@qM=(aNAI z4N@tYksNcpggM>liL0A}{L*n#lnXtPWx$JPFapJ=o`OSho*A*kk!XM@u;4v*Kpuey z;V+p)O_JJOxTrG4m3fDk_c{`7oUiVu)knxZPc|)zOYT!(Pr86pnHAtRYN~%0<<7#1 zH#GHH! zA9qYw4OW%-s9a-);9*m6p`deKMMgt%D?;%6-}p_?gu#g%gfvJl|FrTl~7*{~_p0U<;z=vQOZ7aK*CAR$KPn zoImRj$0!5eYJRm)gJJ)@+YH~{9u4q}g5Rw;vf4o^iRN_TB!!-nMfQaMIt%2FAYhsP z`~)4%$muD`B42C~Jl4RUs-{*xEaf-jX08PHY|}GP5)*f8xb3XSHIlqD{UyZ4aK$Xt zEtBymtFmQOEXuq<2T5OL?Cnd^E1RgelrTzrbL5Okyx&=MKPvynag-1?Zj8$|rnF66 z53u?t4B_34x*8vEACId*1JR@{{vn!Y2LqEI;4d_t%P zlyk^dPSHrrOp3w2F>dy(AAVewFZS8Wnma9zaZ!mUX#DdK~L8BlXs8-8Df!NCo zHzO)ca?mRWTG1NJ{=L&)`GlZu7fdBlN&Qwu51-d88NnHC^C1n;UwZ)ep zY3ZuYbs|n1F2l16O)*?2{At=LJ7CEnL!k|WW_kF5Eom&q*%|wU1!b7(OO}~jLqVD) z{2@8Xm?6T7MtEK<>sgy~+Alxk%5txxJ#Y$}HFDXwTjK^9RpJo=_qxMzynu5YB1bN?u^DaS=euRciL2jwY0Ux@!eSm`V;{Mux1O1w`f0}r~^OrWeSK3%n$PLCr(-byD}(UM6-?C(#dmR@W=c&>?p%>BbyyqGs2 zt{pV@KUmRQL0nh$9LP`sq4Ade^*(<Ql#b)w zXYOQv>Ux80=37aW!`wdjVAkOX+=6|N4|_;HaB+!ho<7BEo3|=$3;4QaOObV!D{1q0 zszR)M(WgMSnDDs4i&TZ>5eR!$g?lFi-G)e7M8!ZC2tn`!X31stQR1ogNABHP9XxLn z-F$PR9y>KkGQm@f8YarXvGyzI_gL*ntI8!0jPa{s{B;zCfjsD+X^!RPz|p@hp+ue_ zx-*rO*$1$0Ze2ERkeXZ$ap}ZavD;L{V1YWcXDH3+x zpY)h(eU+@xf|Ov?V_Lwu&l3ho2b-9ZTa@kJGVQU(e627t=K!fCpPk1jvpEhb_H4Z2 zj49?usvCV&nvQo6XA3=VE|y7@*M4O_xNuhko9%@fQ{1;KJJ;o@(jsrBO4m6?OOU_c z`6gQX9QkRRe6FGZKcyL-<~rcg(E2HBf}&F9bkGo%3N{V7;4vi1f2~QUu$YdV?OLk= zutfbbA)#?EC%Y6oKFam;>b74Hm@IcoABRaoorTTZ)6QN+QQ9*o&fO#v zcaY>h@N(Vx7Np0i1&{)jMB-2PY|)J)y3JB@7u(ifRAb0;br92#Vc)D}IE4S|sk2&5 zj~3frDrwlmG4yB+cXgX`3DIaRUSeW;j2a2tgNXzil z=(%o2OWCqV9?^-2bDwTKCD)Lx=2ZLVE7M!r(=2qr8q7bEMMIIdD6LmJIf`542zZMH1 zQ-P*$nCXPS%t>-#1nw)QS6eJxP=vP<>oDiqedU4+=%h}6wyO$~W$OpuB z#>d&d(^5iQXWu4XoCgo=!r*+nGn^_j51-6#(0G~R{g4CJxKj;+b%yKAi;wAZi7u05LEx>n*_@#;iO`$6 zmLCswVe`bte~>XKu;wEyF4LdJfS9?(^&cg!33v16Mm&e=;GSs{{odPHm3nx4v-~CJ z!#=$WLQZY#)Q7!)j3O461bF)mP}fUiFxpUt!PTj2+!?#djc<`oQqm=7uyrYeIM?S4 zMqqMGxO~aK@Q#6toOU*uSNqlFQGC=0s7b2hB7Xqp9=eZ-4FXj*Q>#mzq|_)Vl_EC& zeC~76Kb=V)H!U`KX%I>b1aPl?7E#O56=W^n(Hk}vblO`3g~;)_aWAGGnDyu0#+t7$ zzOVO080#~_$4uqOyrwBj=I_TLk781QI~yvsRE06h^R$3T=_ABnpKx3`#9*y(wn!`< z^%Km=f3sNH{i%#Xq)pd6txatFerpMdBZ33j#YmT5o`ghu`5hgKDYAanCMw%AaQ7&s z@!X3E{IGV!oUm|ik4R#((QC`1Ns?BE_16An32Ime=4l@c8k}dBw$~v_eqKsu_$z01 z00cKxLcBR>LmW3Y{>T`~q-aXnw5bVU!ESMT)iVu~aF5|FDw!^9C%Y4Vm9OqxFh$nl zJ!IC$bWCRbKm1Rqwq&xz1VHvO#XE8%UpYJ2pE@81Ai=a@ACL@%cQfH#*(Q5nQL07Q zTHznhFU>|YAj?DZI0bS-B^KICn)Do*6r1!pd|O4k3_ze~sBQaEv3xi+DH03L`{DgH z^6Ca?J(y_zyuv@^nPjZpB=9MA&U%=?p!kbpr2|{j;F@Y&)K05zWkQfewu<&D;UcDw zQ+0<2maqe|JldK8o#tm=71*nh3sy z%VphJMjwK_;lGO}-}^V{m8#ynFp=nU@KIY<&3YMbvRUs5;;HkkolQO}i8Uy8z-~1w zK{Z)|Z-;EF1vM2V1FJX`f32?|WturT+isOm2pFY4j5~JCj|3I3l!8GtiTve@Tg6xN zSS@XuqZFYQej`T!45hl=-4l%`5?AI}a9!NSsMdpN%nsSa=sg_*3X~YPIOr&ZUdrR< zG@YQc5T!Z4aE056^!9U?rZqL>zjAer>|j8Ehk~Nwox-AaXb6o?>3mfCZk#IE;6!j` zWror#m9|2VV*sjO>wl{r&U#l-Q+?rDLjXK3vo?Ag2l3}JxU2}%iyjztSb6pHxO#Ga z2%GR1vBALo><(15MBo071lYhST6gQO1j!WidG=(=Ud?H-`oIUn=_H=+u-;+wmS_x2 zK>kD-Gh9-XLW3TNR-<~51fao{xP;^w{&)dgRJ3{gEUh(g`}2OS>N?x5q5HdZf^Rz% zA{4J6Qz~inTD3lsk$;Q(KA+(nDR0!Df5Ig4g%kH7{!sA1`h2-4AKm@LAP|-MV=G0& zh^2uz`e1lHqK~7}E%~P@r`=FcE zpN@#pT#MvVm5M%eC(ab4x3oLJI{k37fOKvZ_}@e*Ir2%FMJE%hCeGj}kiaTHiVjr0 zR-zNOocB;Z2;STY@+7gqk@+~IwYsWx`)(ju~Kf!y) zzHmdXK3%!KX#%a`SrY80X~?1c|E{ZKZW1neGV~s^d9S3`t*bUZws%TJ-2a-o{`xq=o=>MDbXog#Zilu|wMmgM>1xmX#uHO?uh9 z+Zte_gJ;5VLh;+=GJ3qAGu7kW-ejM!eMKYvukrMMY*btJL~P84BWlpS!d{?{wUTgl_1C~ zaiMy72v9I5z);oGH*c!lYPGh1%`GFwn%1mF<&)%vM5`dowgLOarZs!0TVua;RnUC*A zup`S87OoyWqfjK_DTnUJHMC!}1s@rX9o#&JShz=Q=CUU;T!Z?z=@N5wc9;&h9ha8g z$ORB|;Sw~R@fqa8Tgq> zt!v+c7u*j}##)-k@!{PI);85dciL~Wy4|E~cu(vN4;sAOg(#BNjfCuB~Ja(fz}C^?q{`>w3QcbxEa8DrM* Cn(^KM From 28a3c551501d4166834a4f729f42b85fddb90425 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:12:19 +0530 Subject: [PATCH 09/20] Delete terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- ...-standalone-es-go-test-terraform.tfstate.gpg | Bin 17601 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg deleted file mode 100644 index 5be6c905cd3caea7afcfaa80b5de5066c03137ba..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 17601 zcmV(pK=8ke4Fm}T3Y1G_N-;fkga6X%0nODQk!AOX#HMrk>CMvWnM4s4WQpnll!MER z#(ia5s$8#+=w@}A?Iq5$dTuxBW)Osw0$$YmH7s9}W(xSCbAX;?0JdF`$42C%#Rqqz z&p91B#YMCqRvZjc3}PA7jxUgQJ-=RK1*pap73c@+1RTrjKp=gt*#gAzH6zBT{fB^r z5PxF--&(EbO?*wVzRYNKgM^8ZDAeV=N-aG5R}Rp`Z&7g<9*->N20kyrOH&IAr&rOPM5-XSo}I3yiI6srNiOE zw+9U?^ouR&CXT3$nKmiFEXD)QF$8#I(ULqg={cd4{F^rT$C`zuYmCa-hGbbmwPfn( z6uN7q3tj)Yq|OCeLk2TPWWyuC1&=GfHjbx zpM}}m7T`Crd5HqM+~S9t{YZoF^EoWAZ31iTV;6N~4U?rlB1=DH>+DmHHclgnGgt%k zElqtD$Y5ek*DVHAduoRSC^eT1DHsuvi56JacJ}#~GWM8j$%{Qn_jQDD*g;!)_GB?z zFuq8WB_|cT$`fch3t50?7WvM4eXsPTgs*m!<_^#~Iqfn%)?@`C@Y-~~iO(jfdks-$J&|X7S1^+@A1rQZg*yyF-r8GF z7QpFJDMP-ZF={=KH8MV!L{cv{)psM^Hp^I?gR`^XS9_J%w_EE$d=qsBQGzN$4lhZ> zPO`ccNpQ=7DC`>eKiNi!cUWk&RsFUHN4m$CHIDO!6I8CNUbUPHgqUmT=C$#6=IqtQ zkjLCW%-*HYB~7a<@DCOxeOzfBK1uJX2iw~cFM|cQYiMuL>nw1{ZT(D~p~~Mh&mP{{ zTmS6ZB!u+R;R@c<)xjt`brEdLLQHrIZ+@GaldIo$B^D8Y zO9CSxa>@AUZl)Q1Fgl~EbtWoaUXDM63j3@`e-J0h?{p{pLI!&ljMgGPrxpt?E=7Yj zjK`Cg7xj2NGAeS$$No?v8&bUWD1$Xk!^;qtb;3mccrEX>Va&Iy7Y*So4Uf~ z_*0!|U$Q;M>KYLtNo>&D>fgb9*4_K5{FWpT%L znHUM2DJMqss!0Jg1zT4pUBCVc?NJkbf8IpGeZ(|JiB+o<6cU)>`WrYCQy?8QH=1Bl zBTR&~qYh)u=DZ&WgpJ)#R4>Tn`qaU;|CV{&*OX@=HsSJ#XEAromEsFJ=dS8Ust1SH zG*hS725DvyvZXBfLA<0iZ-pxSH}dHWh3~AJM~Byeh01PdBT*wj9c)IfoeU+sl#t96 z0r$dRw?kk~EvCw$!OG_NrikvcN^WBLQYrt`|9w>lOghp*oEmiL>Deu`!0Ooy%`yQ* zF*m05Q4y~sFNzb%1zqfEwiMcv7|p$)BXekjTc#tgPw&<}^(=a;7W$HA&$!Us66F!) zaE#ZIP?K4oPb|%d^ZOUQ>LUCs#G2wKtph;RK=k!%)UL(spYP9g#i?XUh?)6vnAO`m zfc(q==&0OyP@XFW^(NtY+J2G%V19aag`S zC#MU_`Gp|sC>yd?;|Xc_5Ma%ta&h!ur9Hz?Oe8+dAcC+0Y&R2!N<-4yTF+SyQ?(!hDn=Vib0xW!1N$%{ z7x$6ZqMD6jN1R$3_SPXJ_7sc(iXKLn01?jpX|sy}(LvC6GJCefG@1awP`>()5a&-k zyPx_!efcVT4}6S3Fg%ySxT~}+SsA+(5x)qr{!i1)GKu^-d{Q4t4mY4>GC5v%7jaev zBY{ONO6=;N+4C=Q%nGCF##V)TSYi8g7U zdApk|`dyhYOcM!7HUNMt=GK1{-3s=N+}PF<5a>;)|9#rUTbCP0m$?h1%5HM+=>AP|6G3%t3sO z%7VUAV?`}G>XXa83Y%sCKY{Z&s>|ht!bVCPo6Iy}c@XTvIgE3*S|AWrKI{~?rP|9) zw{tZ*&l;OZEsV_zGyu#>aR#Dr@0Vr5E~*6;4N}nHxNfF&7_8IN_u5XFswOBYi>^ca zHTz3)V_|N5fG2V8oj-+w*E zK{>P?&3%+dH16XaEVBN0a@M05|6Hi_<~4|ZsxEQZUj{UKGdi=uBUh&g(d#3mV5!9a zWdR>>6Qf?W{TyB3L&9C0z!gG)iW(tAT}ZUydMVy`Ix&6}wWxkqS18~usZ=5)CTq3` z5lxB+^3BQ-8pBzbei1biBNDlG;#qY{J@RlUEfcL#V|EycR5YH@%x?W+ zBKYH3PFlww_=1Cubskf?WH6v$WkysdlM)Xo(j#6Mg{M`uf`b(yzqYX~0l2L09EtSt zX`=hV3wAd6KySk+gyMvsDxYDlT~&vPsR0s9qNYpqhx!~4_&1ZfUx4Ul4`U93F=#z+ z?IFL->)T#~!!aTHQ*5{~U7ce-_qZHwcR7BFEpK9EjRJJ}Ja?}4!uNt+_?yY+j&$=c1G)xqoSLIq5J8b* z5l^MqQr1b#Ye^qMZ8Qy4#_Suu{=%oZItX~S-NWp+|A6X&un-bZc3|~a z9Ab`B46u*+>~U+$7QaXO{2{6;F96#DKHG;(&w7#_P4gTJWDQH5#Y?zv(Wg4qT(2Tz z(oxZ~8^oGR5&$0ha?Xu-4P$)@;k_VqY0GOKDLYe}TEmXYo#{TMSGU1>B|};tx`Yv0 zmY{z(<)uo=dXw?t{T%IKgGzd7l+~P=M*N_&grl+OaNlu&T>K3NC-{|^bhIn%B6@E3 zZq2#X$jQ8JD;+XdHzozD7*@6|(h?$2k4D#|6V{IV@CX}G-W zan~X>1Lup1lF&WY9X4;^P&&hV^tQu&ld0t%vWyxppXxhm~`PUJSTp z;iKPs<#nl?WJSj6E0@{mnWF7khB*9ZQisMT#CanxIWDx!20Abv?yD7uz_G5<@`QQv z`MGid$nt5cC}{d-D=M;g;H}Ly#xu8B@|&v#oQnCWsfje5^6;V9U>?>P&H#+1ldkQN=)%_3HJrKPc7l=8s+PP3n4u5@j-ZienyU2N(^3 z)|ITkqj8yn2RVU(Ru^fFLu$oIpbbIog0X(UNOq%tXpnQA3XzF}EdPJ7;i1eKX`{Qi zUB-e(|9y|v(B~v`DgLbrHF^*Voc>-+g4`6;t7w5hV77i8A8{Q(0Cs=f26mZf@mEJ! zB?2ehWBlSgB_sgpCU#{+eYApdI)oVs8fYdD)*3C%&w~!aNRh0yz zJamtTkpP{VmS1;!qfYghXQ4orfqO?|n1@)TV!JyUp4__w)C+roUmJxnskOmQFoTag zh3|9b(e8cz+|ZX3d#}AX!&b4*8i9%{sYNQGKg0)c z<|&~5n)d@2nYwr}ZOe_NAJzzYIZ^~qzXcW^-}tJJ`no^vRgEodHB>4vK+QWoRcAn3 z{X<}=D%H7I7$$x)fs})^BZ~EC@0^Gpg}%Fs8yWGC~ z?R0f0cd-ZszhGnS5m)RpMMKEQTQR4|m*mbFAN;Hp(&FB_G2K`(9G~t5^SRv?0(AFT z|6fq`a^M+~rZ4SO!NXU{c=#Adp@1i2(?pPj-Kznb8rnkq^nI8EgMl{}8VW~iTkL{{ zZ5byBFsB4Ld*7#%-A5Osc=&g%$QYG_cX2VDqJCx8v*duU#A=QV@oQAg=K0U7S)bQ= z4WYz~JbYcWmLfHs22R;e#27@>w7%^^*)L;ZsBO1cc|_C-7~Go1TY$N^us8zg%uobdK#udmoxv3PWZotCu3QUlz}_hKi1 zqG2E#4(Y*~_V~I!=*Gh-^TF72`<+f`j}tk=MhQt5r}cswKQQwoe- zAd#{T0edcdU({jSYm+(;_nsfC09+1Hs&^)>BUQIq`&b{tc`?edc8^>bPN0t?n4&*YiNVFD!i zhYb9(Y@yurfv#Qdqxf(zWxqzByZ}9Rm&}6Vc{vz)!3CK- z+-M#En+ie0(aPn`7zWA}WGL;^#(Q|mkw=ICE_#kVJ7GVJ!5<06>ZyEIVJVIN+o`<1 z>66L4F9Hyitj?{?lNbiN!5hQIk8Q@PKp{hRNlxAt(tm^^!U#`ZVP+oSqfI^2ElikXxT_OaLe<)#ShKwWLX>@oOEz1gk&Gb8=A z3tyO7=4-Mr%CjHlZic}+bN?^~A0{a%{Y;`t@Cm|sBLL@iH_E<0#DSi`_B^P>>FExK zymN{4-7!!x7GVfUxB8LD;I#d}s6>|MQpi&Fqo#;y*iS6+SZ&F*i%qZoB!i$po760{>8H5>&cGAX4Ax-%Nq~%Q7 zRp^uz#L;>DAkz(8*bDF2M6=U6BDbZ&JemBm2z5}d#Mz7jn@7b#Q`sr; z-m$f`1Ok3q-u@YztU3RXbG7B$3KGMRUrE9Tj#xIWHNE3c3IQugaX$gu>g3Cd_vm5{ z5_-hhcq)$|!-UvH=im8SC=BJt-G@HCdCq~MNIVC|E6|dSn<}F)Cxw(e?!5wOCtqH( z0o6}dGp{m_#xqzTfb6d4FSz5LiD-&WiA#eTa3K}td%ZjCyOQOUtz!MNkmMaqSW@4G zevusDP9S52j-O>2)Y_EWM8S)p@NNvVf19tvj2(FnOlzucY)&YwUMyr7S*HcrvMiOAsR=0a>xOy*)!d?t@*bDi1 zLn~>_Vfsvxz9}Q_tyC($&r#|als|>xf0(!)Pt_%3l+ zL{Ny9W1t57E2FDFq8Hlmnbuo|*^UPzQVOBr58;1k-oqW2!t4E<`vl6<9L&?EA5@Aa zQS2z%t$YdRL~A|Ic!$Iy?}^1$`-f5^_~cI!`|YK`ZDW?hh)^oF!|<#-*65Q z!g!!fK-I(L$-gLQj|hkR^t+>Z{n%5kQ6e2`xA`Sn$1@>!9Ku}0ih1;E>eyeZ2KkR- zBIkYaTnOOlBdTQllm2^)3}`(CdX86ok?RtVfj2~CWB}~_;bv~G$bxuIO4jwLj?};O zX^avz{h;XDz75hgfr#CTN&gp!W1O-HKJfo}T~1{DRZE%%tsWcv>wPBtJ#V(jCcoP} zt^#3Y#{21(xQ}p$T%`K~i-1E;kI)C8B$vh6iRwIDEzQ8O+>mhGyvmcM7KIIq&eLTn zEu2vBhUntEVL+&}Q~ZOjy6^xoKF$~UXlZ%Bhp<|vQ>d}!h;xM6CzY%w?e?f^Lf=Q3 zJ;1z^yIn{XJ>fPlYZj(c@TVF2VShE_FIiq>i(mwt_M!(HsI83r8UYN2aquBl2B(5x z;`bD^o-6fRFHiXJrol9Ke}+#oopseHkkr;y%U{=%j>Ay99S1T9Iiq|ZqXE11{Gr|0 zQ0+-w^{4Pc!u(WuFSg*5H!ggKtj>|k(2&{+GlWbT`7wmK~psN>?~we8>pL*&tz-fVIX#L>vmg!YSXP-o4^ zGR7)EdNjCbyGC{d`@Os(K$H<_fPo;8MBVUPNw@c(jkbWCc^XH&vy=Ai28%_T!f8CYnnbq>5xczcA|e9`2jtMYkX7=r@z zE|=_^JC(Ta>Wd32Fl2_OgJ@%}y*4ESaPgCakyGF2NmL|O*PP(@Sa`_soN-;w#A}4h z6j%#45?5C%fyL!evc$pygPBJ%TF8W|(UtX-wPZC77cF^vKhy0JV)(Id%LynX4hk+4 z?-fwpZ^g%*<;aifHIYJ-NyvG~MY(YGLBcrH-jGu=N)pmtZs;2;h!FX-B>}y|JL2&$ zj~l0Pj2q}cJ=O}*?I#1WU)*Z?er7a52eg(%;|!23#xf5!qT-)m%;e!+!C2a4CzTf` z9e9HWbD&7uhv)Tng@YY94lB@8OXovt*KhcpM$-1m)%`9oh_MK?Je3JTSWH!mPMx|_ zy;(g1p;*3L5$54tkdzi(aM4ep)_@?B$ZUNML&>YJ#J(0!q|;gKQz)_Wpp7(Mg{KWQ zpOmK$X%~0C1J-mQSMSo@2C(dUI;h)cm_k7_5>)1@BIf4yi1@XaXCxlQN0J#xN~c?X zM2%=*uWh=!Fwj^3Di7NmVS$L~aH`{sFTODEVpdZ49NksEd#JRZ*{h!$nspFag+Ja2 z!8La7e5}ih#tfaE{TuzXd({{o%pb0A$0fPQUm^ij(@Vo<=PPi{$zF34{?wIbmAKf& z4qDz+I=dO3^Qd?FCb5L7A@OE{X{`8IIkV!6DK?|^e?nRF={+n=&AVc<%Qy#=1+IwW z*kfyoo^_d_dJim7RkxwrG`kbeF)>e?TEqr6=+36o% zKJ0Smpa%#N!1AT&d*06f0r-~5Wn1g`5dxzei7l5>lz`QUr?=w$cjTYn_LRoh;b5_C z9Jd1awoxmgM$-+JHHAE@Sr0f+_kN3N2?pYg-M#Ep?*xwx1xX*80Xn>Y6OJ43ov^j2 zGaGpcbtyVJFxh#Uq+$FwF&BYxc$j=jJD0=^1d>$$S_R}1B_zDZx>teBVRY0_sd zo2`uPlWUI~-*%+M`&qtlMm9Jd^J-J4BWn_8`*KY6mgQtf(l@2{3*z*lC@3jY;5j4> zp(_`Bo>rO6FI0QQ>{lb%5GKEQm3&BkkTWpe9_w{KGuvv315o*mOta>6ne6EN-i2`BsLbXIM3>{%i5y)rKRx<46QzH1 zT8H}?o*S9&Kq85o6}{Mdr6ViG+oF7Y252MKp~jk^T2ht))Qq6wY@2miZf=V0+hPw$ z#6u4K91d(!s*5BIQ#a=R8*CxQ)Vb}M`h9Zdl4!2-U0K6YqMnDMCV6OjWcb-S5{i{G zm3dCZ^UfpS16^V~utOuCQf7?INn()oxQY#0Sy2?h_lgM+yftb&GA*8?b2e}`Cw}8U zhg(!v2IUsRvffOE7bq9)gjw=FWj9CYK%CCnFAr0S?>BM`@F~! z1Cm#BK*sJ*)Pw&Dkao$xbQ9Xe*CTYH(r->4lB3PE(`<7{abFuJt^ZVu{sNiYu*oPB z`zWy^$9;l77-DU~z{OA|kEe=jXViWRV_N1&?akpCOG`X4uzepH4ylXN<>6s6&QGy; zr#4c0wv#=ob~#C-n7Y~4(>!h)U#_e$zeE}=x5W9W!A~x$1SWU#>KpLf%e=!g6KS)u z?G07xUentM3()tn%#p1OfBKO_3*DicW2wso=Vpb0N6J;0?v9-&yQFd=AgQFbfgDUB zgo2wnczpIQy#{qYQXWkKuLO%~adzyz<`~qvuXf*?#U!8Cd*PK`I}3$XVH|qa8^WACw!;;b-hAQO-^#I zQCLg_q;KD2x;qF-t+dbt9&F)7@^|B0?Sd2(E~o>`L{TlIF`5$t!NXOx?>bQ}GDCG&B`itTqB&x%+}x=;XCiRX&p~Y+7~%|j&An|if{oUasv5IA)`+z( z{}MTJ7=O<|{d++94M}Mv6plR(L})vv43G12L*lWpxO%MNezZY06AB$n<{bR}a$pMV z+PNrBmbp^Vd?N#raRcnl8q|(KDEY_>DJt2b2u$hzUaRq%LT-~`#mtZ_WP~$d%?bk& zg;N?zx{NBj<0(AD^ag+CRkOyiuVyT$rjJ0!#izDpc}EYU+3RfXG5qe!KgXEm4u5+A zd9)V8$9K&3e#RnVnqPE6h0HVJ(+~4h$dqdg?B=>@wa~j1RW~%@Ecuy79^O% zyydksOEBFJR%@zpJL)_@B(xZ1)$OF&D|!g4n?^g00-ftzJ!-K*1RhRa9ExkS zB6t&|6U|<~9nptO;fkHd8kp;j_`Ql8=+D3bao-*oI&?7?8DOPH+f!515%a;%l?GLC z?xam;nLqLM?nlrtrl2-xsDxMz$oUDNrTZc^vsh8)ERIDSaF7$9JC&EEe^QzTL*U90 ze!u?pT)T@vRAR7Y1$JC)c$bvp(`|F6sV+|dur(8_nAS;fhXNk^lVjNzZHt{@RrwtL zvqxjT$?LJ#R+xUGlL69HD7*>&(4EFYev?hYVFXxja#5LCPa+NeT@D>cAc8-WVNKA1 zf_uJEr?fdTZa@Zjs-GaYwRbP8d)mowaK%~BroUZ%C%2rxgd@%Zzi%d1YD{> zxARp8Q0hXI()~K9;p|tec@9Y;9O}pRd-9XAxAv_Xm+pst1&pBt=(a)P+u_5c6U+v< zkF&}Bg~Q(A1V}H`i4+I!bDWajN((WOOyq+v?&g;7@v834mR*23>M_#erf^?YfiXjI zZp-x1IBMI`8Ht}hWfgBFI7biMJ?FM_{`8X-wzdpsQyc#oZ0oAnkOM{|L5$Tu`FV+N z>002+{vaqzESmS0sgzVLevOD2uGLs$^c;N`!;=_fq7JU>=X=FElZa}yaeHbQ;nSuC z(6fqW*jyh!)nF~Mg(!9u;jkldSKsDdsnwOz#nvL@1iKfiLdF40v5wEC)+o8|w3WGz zhW|IJM*Pp7Xv6jCiPp}GNwG6}bwj@Ot)Y#9CS&c=Z#TS7+{B|GdGkN9K*eDY=p}R~)Jd9c5>Iy!6p{o+4Ce6RA{7 zS_EyTjnNq?HJxXafS0d!EedmuA{Ww4v!9(PYj0CeM=}4K_mC^YeS7sKK%Bo2%|T$? zi&8(NS+nw!b+!_o3Y)Rn>Jb>>CW?>#OBAzJ;^<`b|B3?FFHnanch@TC?xVk4czntT z&PibR?Bc3fJg!G+uQ}`Qdl1!Ir;j-hFUR3xThe6QVYTZVsLDBHZn`pOUpT^p!F~-Q z&j8Nr{7kh7_qO34BOKE8Es%@7J@k=7p?_(BK%8okNmPe6=ArcB2aIn-lam$oDNBI^ zrwO5ybrfe4Xq%#Ae-q_QrZ&_R*_{I1v35gOWSXd*Fdgs!DkgOW-P|gWrzXEtxl?ql zxJsV^f|U04n++JC?!5n7nE8ddZ(b3dRBs-#k%g*i;N?*d+^0zQe5#FGG|J~bVIw_B zvdzy2>Bt=d!~QwPLJ&~7kqPObp4%$$DBMtaP)zgd$-YXlH6GPqOro6lEfJe-pG1XexQql+fy>MoXRF*ow1*V%-5qwOdtf|4mU#=vbihTAG`~^1OnApogHW$2UJg zt#i0)Tr6oYr1~G31jd>R>JA@?0hf)7(POx9UZL9H(PZHgC%b_a!$=B1^tB5*Al?T} z|7=mI)!2F(=->+EaA_dF0V)A(mDPI3L|e0Ph0K#T`n)0qxwTxmN*cCI)5J!(+_BqS zNO%;mn9{8oA~6wXk9*F4S#_9xC*X1uh*{MhhVcP|vCU_%p=6Dm3K?#i#{`}5Zd-c4xg>_bH)G!i6{@Uy|$O5@ayZ;?)Xp2P^Pn0uR~ccg(#>ycM7QUm)PDQvMQ+q zzt}_GTup9$^O{zopSy_Jaal zoJPhq0mdpjiD))iTRKR+G|So@qScF`?HDkRo6C+*<1P?ExQ4BQCidY~hS`nt3`YfK*0_1@}YIGY| zn`2#!s{p_Gui5-U*|b0tm8smpxC^b%hl0`BkjWF+(mg}nz?@>Djx;~%XWxNBLGlgKX;A{;>M?6@+vt#1dGlYXNz3}F(}ET7V-`Vg zP}R;)#Al~y#{Q{XU=(*i-tomRu|n-cJBU8?uyQEEz1VtbI8g0Ubayi=H`%)*{E7kY zCBAu_*~e~e5jWuNp?^6 z<9x7p*Ai3290B7&09V%}7(Jn)iD(50OUjIf;kJLr#%y_iHdHj&(_kBBDzNK#CafajtzdS z-H;1x=GX-wqLW#(w$sCiVBx5Yr`THhmz%io^&e;tErHEas0o^S^F})S3nBJv2iQKi zi|8bLon3+5l{kYRP=*<_ zBcOwvnlV9+dj|{!o-wQOU0N3J8F4~XX)4I1zpD z3qxPph^9&?YxsXheAfvq{gIG0*`jv>6Lv90TJkdXN9h5e)pe+JbZ#j+QBsqjX97%* z5lBjWRA{Q3iXb=~siJB@D9(f+d@umzt=z7{;k#s+xU9`C3>8V^g3`6)#{2k~D#rkY zJ*U;QmuxuBj;6SVpBh7gW!2|D*1?jz`+GvZA0!SrU`|GNz73sM6)F<2`%+0bR9&gY z0(SE#m&6d4O`g_qd|cwCj?zh-$iZZjt>T1Jf$FPM2bT zu_O_D(5E-B8eeDr+J}eE%5iwjLDq$|EJfHaB+EHJ`0;NCQPvRTR!Z7@`a)l84Gy?~ z=QD`(^0?R2()$E`E!qGczoR+(5a*LC?AHn1fKZh{L&0VH=6-v-KgufZ0qqaF?;g-s zm*YT47IKem9KwF zXhVoOTFY%)*bVHX16ql;g=c4C{hd9bk?00mx6H^!4NQKqfHtScsQ6~$!{n&3Q-Z^H zcplNT&jgcii0M*Wi^`_2_`q+QBYy+ha!WswG6q5dY^$zJ$MFEr_cDngYE%dZUEVv> zMzo$|$x6-bKN+52DNC<2&IwU*MVWsSrLgTRd1kdZfF0OTtykjo<8u2hwI@~m`LJ|K zf25bu7U5@H7nZ23TV>h-lF9uf6#I{yD@RY9O7Y6c?(tY25In3>om8!0H^k}~36@+@D9{N26T(K_a zY=rF@L_I8*pxPS3d$bY2Wo!dH4R^*Ge}`0lr|~LfeVG z+~P5qZF_FO{Dk7uA(`p~*YowqQZ1E-sRtGT3+^US&rY5Cw(X?!Wo--fPtD@^h{Qqz z3^zw}#RwsqIa9e;hoLa@L+m%&Ml6+@v2et~OVU`tPl^~J%gg6mhDnCw_4z7{Q@lC9 zTU4R2P6ojQlWX9I1HO%d;+B!=@pratYB3N~b z%ou_80z~>7uD%{D2t||FRfLCS{gZwArIi>_DaVX;clS0K)+1ol`RD+RSg0(B4F4Ev4)Qdm{? zqNoA2h6ZKTl!$=|Appb_xRVndTGjhD&9%wu2~3)qe%RS$NfucRA2Kb!wb5%Q%$Fn7 z5%~AMr4fY6bk$AeD_-VoZM-r>m5o$W0THq(J_TD{e)WM@G`2!P=9I798VK3A%}sV4 zT%0(tjKkx!Nw6{gi-oEEPqS#@~sVrABRKG5H6o_W)3(*lA_ap>U;psR^PrX{%Ds{@2AoaM+rDT%YO z-RdCxK6OOTB4yYxNGU$x3ummEsN$mJ9Q=Ty>g57yOCY;=? zFuDrRVTL(`ZJ=L?UR9!zo=g>q5lkhS)D0Elr*qP?wiM1PE|%sD_U7wYSFW7cZ>vmV zem|pqU*vH09W^uuPRMFd@f^W4jbG;;^NbvA3UzgD4r&&5zVVrgKIwY$gU<97@9!WV zQhe2YGepU476eV%^3WQ8s`XHqp`$=-G`~pe)c3{WFQ=wctKZDTW-C?1 z$p^B`%gGWhMAc#=W{0^9aP8ok2#@8ISXxjLAN^`rdYZ-9hJ%tNNUX+_um|(+l`q2g z{t0h`rDND)t0H4_7~0x6e7e=3K+YG-*9_EYTe}?ixsf4<`6S0%&O;nz!uIW!i}ILS2b?=* z4=W!NR5r}i*1GG-K8cPmD)bsQo}N+`H8U|X=K=#V$aUlJrRBBt8G|!=l0|KKXAmLm z`sv|Aoiv36;&+d44~Ku}EQW|M16KGCi>IEecHsOt$L=FUOG@*zEE~IXU6QOUqGEe?sJB_MzLG-&9Y zF9iZx@MKUC@B{VzGbS!wB9G;!_`r23>vFh@M);p@3ekN=pMv2hF%FvvrNuyNEP!2Te{c zL(aAr40czp#RA84tkDH3mZnz1T;x3_?fqcZct^(O%fIzLvOp0Vw7M_-TCXY|>`*!# z_g|!uHkpeGQZN0vU=AJDvY3*2T5ixF2SSK;-SD<#)d`AQV& z0;H} LoVHpZ=W_sbB_C1GlME5&HI1J%l;zwermqwl0Bxo_Khl}p+blBwn_GWBGZ zYC1UWs`=wiVL!;Tr`k>};c3RezP)C8jgfJ@-iecG0|=0+8J9`Q5T`v0hDs$1CtJcm zw%D>Ae8y-AS0X8yyYBf^MiMqs_h@4Jnx+olF)iNhnUV}VM&pe8mJ4X(+xdnsv0Gdd z1(Hl(VW|<1JV6h~53kB+ccS4sYC?Ixe7 z3BIM2i$RW9aL>kWHI+GH#V>VNLu7YCtcl~KvJ%ob3l(Yzuh3?wcCDeo6{fZA4w4Q^ zXAH5Qkd`%CfBDHzdk_M7_K;WpyI3|fhlDt4yfNd8kwnFQK;B2*Y}(5hY~R-y*<4QX z7$PMT;(!EY5tsRy=hu5tY>coEYDP?bk&4ksimWx2~}oe zF{E8{avC+p?I;{)$)#>+csN1~DI&H_6p7u)pt6O_?PHh89QU5P?Sxw8BClgyi{lSB z;M>{Io?T&wTI1}KcbQ0a6{T$>4}qB&|0EIzLC=hoTFU{_hDP8nERi|z_R;R?At&h- zT`)7mXOgSt}g*`)1h2j&B!Tj>SS2Pf|7$Uo_YaZ*AG1)ud8 z)@6DbFuW2@)(&(jrQ<|#9-bgjesJ<7^Km*BOGWa4&wQqStB$U{Kh>7w2ArYPGOmz( ziwkO)K-c*ir&&o=U{Fc%?5@V22wDKcsG>-{5uH5M3(L5u;9Q(t>{c+XHtFRmSbMAk zw?*5WnCD{t003`eTw0ulkoQPHu~!ivZjF`JOcoq!k6vjHoB=USDjs}aobV7ft^o_1ZH=($dreI z+SF!!OiH`;uS?X?pinDCBanEM7ZgNyS`l%z1mYtNyGUA48-1_ZADcjepn6*Um5U=_XQ^L=)SxPBgcX3 z|Fw#vXwC9uN)mL0Cnuf<$pA}P-P80DT1vwfwfFa(iQZ=os{bwK@~Xoux>1>2!;zC2 z<~ zZhM-cJM*FD_m|p5JhqZ(?>hwMBt}N$n$}+=w;w{MuqAaVOEvO)YnVQ0GaE$8B8P@s7(t5AoLQ z_$>KO+{pD^My-*|^cT9u>j68o-w zG{y3s0$dZH{)=(zNoz=-w_*LcwhQvnHhP234TW3faSqX7pT-jp3T~KKW;=>2Arka% zrQqnoE;~}*^_;S?cZ#4*IBo}jdrM1ubtYIy`S+DvuLc4)&3VQw*j@75IBo|N>SP;G zvF9dn$G3zY!kf}%`;(^3mTyrPNuj{kf6i9^4^ixr(;}}k0hwqPe}1`Q8%-mC-~j`YE`W8HO* zKDt?x-C%GhK>lU#UQ^+Sk|Sg1CSaZV^arRzUCrsjP1E z-m>R?_8S{S!+aVmL(MG77a!bN31$&tbnF6wds0kPS?SLVc0F@BF8eDXVMLarFUA+* zi(~5E1tb?uGld;b$b>PdRXuViVcHqcuEn^1kDlG5B-6U#cFzrP^b|#RPBYPWfpiQ) zw)DWcB+s{q;WL{Q&@u|M^qq5dQ)Dv(g6tklR@KrC`!h)C0RUMARTm4Kj?BwoD8Xb* zDJO{!3Fy~&I*Dqz5#TZst-Y_yRFh`P|L8|8Gz;U%`cwz+GoXAvb+o3l$Syk=`@$#@ zR`NN*QLzCa0vyfP?K*luM30w6;;_WW-otFv(5Ur7m6V(WOv{$?jbHbDW-;}FTwzI4mgk)o(Dd95IL zeu&PgA3U>{By&qCG0H!6=@F?O_722Vf`gm$p3tg1JTUh7mS@!#04qO=`Y6W%ka~2S zr#PH>ht`BRrdg7FN%I{>TnO_RJa?UuYM184SRlA1@TkZxW9{jas`_UuRx=|EyU9CBR zbeOhf1|VdTG^tCFOf~WL1>FB( zh?zi){jf2LXR?J(L(Em0v~nl}mW`#AB;Iv0zZ`EvZt-U34j9f^Gj!rWGV`9+{v(@$ zRX@s`GF`hFKLB(IEdQA7&?W(`uD)w)=Q<&S zJms&)$do6{9qfa^#Z9aHpa(B5k)=#^ty|tTEsR!O88dywEwB?ZXd*Xh2pAliieoIY zGY3-QtoFWbPkOaI za&-Cy?1=l{e&?a#ybv(D+SF+3gF!L(q4~a#ma$OP7OH{*lZ`)1#a%7tJCs`DSHmt~MKXHJacR(qY zuxN2iImuU4F8241d=^U`YiHaLF$0feVNf!Kr{4C;e}@j7!$?io4nYtJLsNKM{7LEm z6-jzp7iuRmP0e}tY$|KHLaeD=LuJiu`YOi0U@aPtp!G{@bHaL$o~#(SU8M zIa%W$eY`6qewA`WG=%mEL0;E7``w5(#ddsuIQ2k71=VpCX!Dq94^>VW;z9-bf!wkD zEa7X&60I9eoc}wJ594i%*jE=Gi`R!REKu=HLIR5n%(UgXc>Q&}S!bMuZq43LZy5Ei zsMVxNW%;?Pj({qks%83V+=xWVflTgSlQVnz|2PF26}bp)4L~$KNQPv{Xvm^V*T&`d zBehin&=YBoPwxqG=Cg#=mI2;k$f`$K5vo|$Nb+qn4b(XL-{3tfd^#!<*k3(#DhQd- z3mcnsv*&ho$ftd8&#N9Xz~KUPrXFy2<1b;bKZ3#LZ=Om=wYFfND(5IkGC{L9)EQ;OG%YpP(iSR z15{~W-YL1A!|5CjM#eVSRJuE*RDRu>K}zuH zMB{>q%|zpo&o&T+S>|Yd9r@w|woxgV;R9(J*!cHpcXc>Sg^Z&XPt3?06ioai!KuZ` zZ9GL-2h4PGt!35AM9$5>YosSO7`aY0?*N!R>v2j>`wG^(L} zH1(|Ys&O}u58P?dhcO;8bhQkn&o5})^V5QZho?qf;{D_&qQwPVtxfS##uqeS(-Phfrke%0N!TgY@`-X@d2 zk4~U`Q*CQZB)6_TD8B5Up$l`%TbM};_TH{rYlVASV2Y9AvPTX54MwD#=cM)tN5`5S zmcf7fczSydI~=C63n+BY|AE1ObF+6~vZpbLV8b&`{imjX96dL^i{ML)`Px3IDO*dLvH(>Z1D` z)6*J|aJ&Ng{`35?ds6E3gnyMCFNzZ%P}BEdCL}2u4q*aTQIfR9@un1Z?ib0L_KLFc oUFSd2BL=wZTQS@Zi8LJrJVvNeM`a(3L|jF0THz)~toWjSD#9F2yZ`_I From 823c58235ff2d86760e6a68355466684b365600c Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:14:08 +0530 Subject: [PATCH 10/20] Updated aws.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/infra/profiles/esignet-standalone/aws.tfvars | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index f38f04b72..85198c9a4 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -7,16 +7,16 @@ # ============================================================ # Environment name (infra component) -cluster_name = "esqa" +cluster_name = "" # eSignet's domain (ex: esignet.xyz.net) -cluster_env_domain = "esqa.mosip.net" +cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = "thisisbn46@gmail.com" +mosip_email_id = "6@gmail.com" # SSH login key name for AWS node instances (ex: my-ssh-key) -ssh_key_name = "mosip-aws" +ssh_key_name = "" # The AWS region for resource creation aws_provider_region = "ap-south-1" @@ -74,7 +74,7 @@ WIREGUARD_CIDR = "172.0.0.0/8" # Use your actual WireGuard VPN CIDR # Rancher Import Configuration enable_rancher_import = true -rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml\"" +rancher_import_url = "\"\"" # DNS Records to map — only eSignet-relevant subdomains # Includes hosts for both the esignet-standalone profile and the isolated @@ -94,7 +94,7 @@ postgresql_port = "5433" # MOSIP Infrastructure Repository Configuration mosip_infra_repo_url = "https://github.com/mosip/infra.git" -mosip_infra_branch = "es-go-test" +mosip_infra_branch = "develop" # VPC Configuration - Existing VPC to use (discovered by Name tag) vpc_name = "default" From 3557ac5a8ed6d28394d03373a4c7b842ee980f6d Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:16:16 +0530 Subject: [PATCH 11/20] Delete terraform/modules/aws/rke2-cluster/ansible/inventory.yml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/rke2-cluster/ansible/inventory.yml | 46 ------------------- 1 file changed, 46 deletions(-) delete mode 100755 terraform/modules/aws/rke2-cluster/ansible/inventory.yml diff --git a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml b/terraform/modules/aws/rke2-cluster/ansible/inventory.yml deleted file mode 100755 index a1bbce466..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml +++ /dev/null @@ -1,46 +0,0 @@ ---- -all: - vars: - cluster_name: "esqa" - cluster_env_domain: "mosip.local" - k8s_infra_repo_url: "https://github.com/mosip/k8s-infra.git" - k8s_infra_branch: "release-1.2.1.x" - install_rke2_version: "v1.28.9+rke2r1" - enable_rancher_import: true - rancher_import_url: "kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml" - ansible_user: ubuntu - ansible_ssh_private_key_file: ./ssh_key - ansible_ssh_common_args: '-o StrictHostKeyChecking=no' - - children: - control_plane: - hosts: - esqa-CONTROL-PLANE-NODE-1: - ansible_host: 172.31.64.165 - node_role: control_plane - is_primary: true - node_index: 0 - - etcd: - hosts: - esqa-ETCD-NODE-1: - ansible_host: 172.31.73.182 - node_role: etcd - - workers: - hosts: - esqa-WORKER-NODE-1: - ansible_host: 172.31.75.46 - node_role: worker - esqa-WORKER-NODE-2: - ansible_host: 172.31.72.215 - node_role: worker - esqa-WORKER-NODE-3: - ansible_host: 172.31.77.135 - node_role: worker - - rke2_cluster: - children: - control_plane: - etcd: - workers: From 5513ffda0a8b05b4d69749c20330d866b5179e2f Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:16:24 +0530 Subject: [PATCH 12/20] Delete terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../ansible/esqa-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 720fc904a..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://172.31.64.165:6443 - name: esqa -contexts: -- context: - cluster: esqa - user: esqa - name: esqa -current-context: esqa -kind: Config -preferences: {} -users: -- name: esqa - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From f787bfb2ef53c430346ad554af744947ecde3fa5 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:16:35 +0530 Subject: [PATCH 13/20] Delete terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../esgotest-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 9681f1e26..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - server: https://172.31.66.49:6443 - name: esgotest -contexts: -- context: - cluster: esgotest - user: esgotest - name: esgotest -current-context: esgotest -kind: Config -preferences: {} -users: -- name: esgotest - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From 6a6bafecc7b21e38303cf79df887fcd8fd05ee88 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:17:54 +0530 Subject: [PATCH 14/20] Delete terraform/implementations/aws/infra/backend.tf Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/backend.tf | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 terraform/implementations/aws/infra/backend.tf diff --git a/terraform/implementations/aws/infra/backend.tf b/terraform/implementations/aws/infra/backend.tf deleted file mode 100644 index ff4cc9846..000000000 --- a/terraform/implementations/aws/infra/backend.tf +++ /dev/null @@ -1,5 +0,0 @@ -terraform { - backend "local" { - path = "profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate" - } -} From 48da6cb30980b1fd854e9be4562582858681f712 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:20:44 +0530 Subject: [PATCH 15/20] Update aws.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../infra/profiles/esignet-standalone/aws.tfvars | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index 85198c9a4..a7cfa4290 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -10,19 +10,19 @@ cluster_name = "" # eSignet's domain (ex: esignet.xyz.net) -cluster_env_domain = "" +cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = "6@gmail.com" +mosip_email_id = " 0 to From 924e37f17110f0ac1b843e16769019ca10b2db50 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 6 Aug 2026 17:25:17 +0530 Subject: [PATCH 16/20] fix: replace hardcoded P12 password and crypto encryption key with secretKeyRef MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeRabbit flagged MOSIP_P12_PASSWORD and CRYPTO_ENCRYPTION_KEY as hardcoded credentials (CWE-798), duplicated identically across all 4 esignet-standalone-2.0.0 plugin-values files. Replace with valueFrom.secretKeyRef pointing at a new shared esignet-go-crypto secret. - esignet-preinstall.sh (shared by all 4 esignet-go-* instances) now mints esignet-go-crypto in the captcha namespace from two new required GH Actions secrets (ESIGNET_P12_PASSWORD, ESIGNET_CRYPTO_ENCRYPTION_KEY) and copies it into each instance's namespace, following the same pattern already used for captcha secrets - helmsman_esignet.yml: wire the two new secrets through env passthrough, masking, and validation (required only when profile == esignet-standalone-2.0.0) - Deployment guide updated with the two new secrets Existing values are preserved (not rotated) to avoid breaking anything tied to the current P12 keystore files — the secret material now lives only in GitHub Environment secrets, never committed to the repo. Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 22 +++++++++++++++++++ .../esignet-preinstall.sh | 14 ++++++++++++ .../esignet-mosipid1-plugin-values-2-0-0.yaml | 10 +++++++-- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 10 +++++++-- .../esignet-plugin-values-2-0-0.yaml | 10 +++++++-- .../esignet-sunbird-plugin-values-2-0-0.yaml | 10 +++++++-- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 2 ++ 7 files changed, 70 insertions(+), 8 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 170fb368f..a7eb3a817 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -143,6 +143,10 @@ jobs: MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }} + # eSignet-Go (esignet-standalone-2.0.0 profile only) P12 keystore password + + # crypto encryption key — shared across all 4 esignet-go-* instances + ESIGNET_P12_PASSWORD: ${{ secrets.ESIGNET_P12_PASSWORD }} + ESIGNET_CRYPTO_ENCRYPTION_KEY: ${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }} # Spring config label per namespace — controls which Git branch/tag the config-server uses # Set as Environment Variables in Repository → Settings → Environments → → Variables # If unset, hooks default to 'develop' @@ -209,6 +213,8 @@ jobs: echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_P12_PASSWORD }}" + echo "::add-mask::${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }}" - name: Setup kubectl and kubeconfig env: @@ -418,6 +424,19 @@ jobs: else echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" fi + + if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then + echo "--- Validating esignet-standalone-2.0.0 P12/crypto secrets ---" + for var in ESIGNET_P12_PASSWORD ESIGNET_CRYPTO_ENCRYPTION_KEY; do + val="${!var:-}" + if [ -z "$val" ]; then + echo "❌ $var secret is not configured (required for esignet-standalone-2.0.0)" + MISSING_SECRETS=1 + else + echo "✅ $var is configured" + fi + done + fi fi if [ "$MISSING_SECRETS" -eq 1 ]; then @@ -440,6 +459,9 @@ jobs: echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" fi + if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then + echo " - ESIGNET_P12_PASSWORD / ESIGNET_CRYPTO_ENCRYPTION_KEY" + fi fi exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index eec0071d5..3885cc0c0 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -80,4 +80,18 @@ $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" echo "Copying keycloak-client-secrets secret from $KEYCLOAK_NS" $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" +# --- Step 5: Shared eSignet P12 password + crypto encryption key --- +ESIGNET_P12_PASSWORD_VAL="${ESIGNET_P12_PASSWORD:?ERROR: ESIGNET_P12_PASSWORD must be set}" +ESIGNET_CRYPTO_KEY_VAL="${ESIGNET_CRYPTO_ENCRYPTION_KEY:?ERROR: ESIGNET_CRYPTO_ENCRYPTION_KEY must be set}" +CRYPTO_HUB_NS="captcha" + +echo "Creating esignet-go-crypto secret in $CRYPTO_HUB_NS namespace" +kubectl -n "$CRYPTO_HUB_NS" create secret generic esignet-go-crypto \ + --from-literal=p12-password="$ESIGNET_P12_PASSWORD_VAL" \ + --from-literal=crypto-encryption-key="$ESIGNET_CRYPTO_KEY_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying esignet-go-crypto secret from $CRYPTO_HUB_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-go-crypto "$CRYPTO_HUB_NS" "$ESIGNET_NS" + echo "eSignet pre-install completed." diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 697de99b0..e89a64b79 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -64,11 +64,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/mosipid1.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 96e42db3e..f915ee073 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -64,11 +64,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/mosipid2.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index 6f53b8731..bb20b7512 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -78,11 +78,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/mock.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index 54f52350c..1b30dd47a 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -66,11 +66,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/sunbird.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 4340b2245..1c554a9f1 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -174,6 +174,8 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | | `ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-sunbird` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-sunbird` namespace | +| `ESIGNET_P12_PASSWORD` | P12 keystore password, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | +| `ESIGNET_CRYPTO_ENCRYPTION_KEY` | Crypto encryption key, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | | `MOSIPID1_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID1 remote MOSIP environment | | `MOSIPID2_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | | `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID1 remote MOSIP environment | From f160f6566f296819724168e9929059bb3af87010 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 7 Aug 2026 12:34:03 +0530 Subject: [PATCH 17/20] fix: switch esignet-go-* keymanager config to match upstream PKCS11 integration, PKCS12 for mosipid1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follows mosip/esignet#2331 (Keymanager integration changes), which removed MOSIP_P12_PASSWORD/CRYPTO_ENCRYPTION_KEY from the chart entirely in favor of KEYMANAGER_* config: - mock/mosipid2/sunbird: KEYMANAGER_KEYSTORE_TYPE PKCS11, using each instance's existing esignet-softhsm-go-* secret for KEYMANAGER_PKCS11_PIN; module path corrected to the real /usr/lib/softhsm/libsofthsm2.so from the now-merged upstream chart (was a placeholder) - mosipid1: KEYMANAGER_KEYSTORE_TYPE PKCS12 instead, using the extraVolumes/extraVolumeMounts capability added in mosip/esignet#2333. esignet-mosipid1-preinstall.sh now generates a throwaway self-signed PKCS12 keystore (create-if-missing, so it stays stable across redeploys) in secret esignet-keystore-go-mosipid1, bulk-imported via extraEnvVarsSecret for KEYMANAGER_PKCS12_PASSWORD and mounted at /home/mosip/keys/secret for KEYMANAGER_PKCS12_FILE_PATH - Removed the now-unused ESIGNET_P12_PASSWORD/ESIGNET_CRYPTO_ENCRYPTION_KEY GitHub secrets wiring from helmsman_esignet.yml and the deployment guide — no GH secrets needed for either keystore approach anymore https://github.com/mosip/esignet/issues/2333 Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 22 ---------------- .../esignet-mosipid1-preinstall.sh | 23 +++++++++++++++++ .../esignet-preinstall.sh | 14 ----------- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 25 +++++++++++-------- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 23 +++++++++-------- .../esignet-plugin-values-2-0-0.yaml | 23 +++++++++-------- .../esignet-sunbird-plugin-values-2-0-0.yaml | 23 +++++++++-------- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 2 -- 8 files changed, 76 insertions(+), 79 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index a7eb3a817..170fb368f 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -143,10 +143,6 @@ jobs: MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }} - # eSignet-Go (esignet-standalone-2.0.0 profile only) P12 keystore password + - # crypto encryption key — shared across all 4 esignet-go-* instances - ESIGNET_P12_PASSWORD: ${{ secrets.ESIGNET_P12_PASSWORD }} - ESIGNET_CRYPTO_ENCRYPTION_KEY: ${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }} # Spring config label per namespace — controls which Git branch/tag the config-server uses # Set as Environment Variables in Repository → Settings → Environments → → Variables # If unset, hooks default to 'develop' @@ -213,8 +209,6 @@ jobs: echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_P12_PASSWORD }}" - echo "::add-mask::${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }}" - name: Setup kubectl and kubeconfig env: @@ -424,19 +418,6 @@ jobs: else echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" fi - - if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then - echo "--- Validating esignet-standalone-2.0.0 P12/crypto secrets ---" - for var in ESIGNET_P12_PASSWORD ESIGNET_CRYPTO_ENCRYPTION_KEY; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet-standalone-2.0.0)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - fi fi if [ "$MISSING_SECRETS" -eq 1 ]; then @@ -459,9 +440,6 @@ jobs: echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" fi - if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then - echo " - ESIGNET_P12_PASSWORD / ESIGNET_CRYPTO_ENCRYPTION_KEY" - fi fi exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh index e0d5ccbc1..ce97e8240 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh @@ -44,6 +44,29 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi +# Create esignet-keystore-go-mosipid1 (PKCS12 keystore for KEYMANAGER_KEYSTORE_TYPE: PKCS12) — +# a throwaway self-signed cert generated once and reused across redeploys. Never regenerate an +# existing keystore: KEYMANAGER_PKCS12_PASSWORD/mosipid1.pfx must stay stable, or anything +# encrypted with the old keystore becomes unreadable. +if ! kubectl -n "$ESIGNET_NS" get secret esignet-keystore-go-mosipid1 &>/dev/null; then + echo "Generating dummy PKCS12 keystore for mosipid1" + DUMMY_P12_PASSWORD="$(openssl rand -hex 16)" + TMP_KEY="$(mktemp)" + TMP_CERT="$(mktemp)" + TMP_P12="$(mktemp)" + openssl req -x509 -newkey rsa:2048 -keyout "$TMP_KEY" -out "$TMP_CERT" \ + -days 3650 -nodes -subj "/CN=esignet-go-mosipid1-dummy" 2>/dev/null + openssl pkcs12 -export -out "$TMP_P12" -inkey "$TMP_KEY" -in "$TMP_CERT" \ + -passout "pass:${DUMMY_P12_PASSWORD}" + kubectl -n "$ESIGNET_NS" create secret generic esignet-keystore-go-mosipid1 \ + --from-literal=KEYMANAGER_PKCS12_PASSWORD="$DUMMY_P12_PASSWORD" \ + --from-file=mosipid1.pfx="$TMP_P12" + rm -f "$TMP_KEY" "$TMP_CERT" "$TMP_P12" + echo "esignet-keystore-go-mosipid1 secret created in $ESIGNET_NS" +else + echo "esignet-keystore-go-mosipid1 already exists — reusing existing keystore" +fi + echo "Creating esignet-captcha-go-mosipid1 secret in $CAPTCHA_NS namespace" kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid1 \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index 3885cc0c0..eec0071d5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -80,18 +80,4 @@ $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" echo "Copying keycloak-client-secrets secret from $KEYCLOAK_NS" $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" -# --- Step 5: Shared eSignet P12 password + crypto encryption key --- -ESIGNET_P12_PASSWORD_VAL="${ESIGNET_P12_PASSWORD:?ERROR: ESIGNET_P12_PASSWORD must be set}" -ESIGNET_CRYPTO_KEY_VAL="${ESIGNET_CRYPTO_ENCRYPTION_KEY:?ERROR: ESIGNET_CRYPTO_ENCRYPTION_KEY must be set}" -CRYPTO_HUB_NS="captcha" - -echo "Creating esignet-go-crypto secret in $CRYPTO_HUB_NS namespace" -kubectl -n "$CRYPTO_HUB_NS" create secret generic esignet-go-crypto \ - --from-literal=p12-password="$ESIGNET_P12_PASSWORD_VAL" \ - --from-literal=crypto-encryption-key="$ESIGNET_CRYPTO_KEY_VAL" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying esignet-go-crypto secret from $CRYPTO_HUB_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-go-crypto "$CRYPTO_HUB_NS" "$ESIGNET_NS" - echo "eSignet pre-install completed." diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index e89a64b79..409283736 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -61,20 +61,14 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS12 + - name: KEYMANAGER_PKCS12_FILE_PATH value: /home/mosip/keys/secret/mosipid1.pfx - - name: MOSIP_P12_PASSWORD - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: p12-password - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH @@ -87,6 +81,15 @@ extraEnvVars: value: decl-layout-1 - name: DEFAULT_AUTH_FLOW_ID value: decl-mosip-otp-flow-1 +extraEnvVarsSecret: + - esignet-keystore-go-mosipid1 +extraVolumes: + - name: esignet-keystore-go-mosipid1 + secret: + secretName: esignet-keystore-go-mosipid1 +extraVolumeMounts: + - name: esignet-keystore-go-mosipid1 + mountPath: /home/mosip/keys/secret extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" value: "esignetgomosipid1" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index f915ee073..7c4890e12 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -61,20 +61,23 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/mosipid2.pfx - - name: MOSIP_P12_PASSWORD + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS11 + - name: KEYMANAGER_PKCS11_MODULE_PATH + value: /usr/lib/softhsm/libsofthsm2.so + - name: KEYMANAGER_PKCS11_TOKEN_LABEL + value: esignet + - name: KEYMANAGER_PKCS11_SLOT_ID + value: "0" + - name: KEYMANAGER_PKCS11_PIN valueFrom: secretKeyRef: - name: esignet-go-crypto - key: p12-password + name: esignet-softhsm-go-mosipid2 + key: security-pin - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index bb20b7512..83c8dbd6c 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -75,20 +75,23 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/mock.pfx - - name: MOSIP_P12_PASSWORD + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS11 + - name: KEYMANAGER_PKCS11_MODULE_PATH + value: /usr/lib/softhsm/libsofthsm2.so + - name: KEYMANAGER_PKCS11_TOKEN_LABEL + value: esignet + - name: KEYMANAGER_PKCS11_SLOT_ID + value: "0" + - name: KEYMANAGER_PKCS11_PIN valueFrom: secretKeyRef: - name: esignet-go-crypto - key: p12-password + name: esignet-softhsm-go + key: security-pin - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index 1b30dd47a..80ec0bb63 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -63,20 +63,23 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/sunbird.pfx - - name: MOSIP_P12_PASSWORD + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS11 + - name: KEYMANAGER_PKCS11_MODULE_PATH + value: /usr/lib/softhsm/libsofthsm2.so + - name: KEYMANAGER_PKCS11_TOKEN_LABEL + value: esignet + - name: KEYMANAGER_PKCS11_SLOT_ID + value: "0" + - name: KEYMANAGER_PKCS11_PIN valueFrom: secretKeyRef: - name: esignet-go-crypto - key: p12-password + name: esignet-softhsm-go-sunbird + key: security-pin - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 1c554a9f1..4340b2245 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -174,8 +174,6 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | | `ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-sunbird` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-sunbird` namespace | -| `ESIGNET_P12_PASSWORD` | P12 keystore password, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | -| `ESIGNET_CRYPTO_ENCRYPTION_KEY` | Crypto encryption key, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | | `MOSIPID1_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID1 remote MOSIP environment | | `MOSIPID2_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | | `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID1 remote MOSIP environment | From 226de62cd5fadde359c8b609597ee0ac246be825 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 7 Aug 2026 13:22:55 +0530 Subject: [PATCH 18/20] fix: use fixed localtest password for mosipid1 dummy PKCS12 keystore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use a fixed known value instead of a randomly generated one — this password only protects a throwaway self-signed dummy keystore generated by this hook, not real production key material, so a shared known value is acceptable here. https://github.com/mosip/esignet/issues/2333 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh index ce97e8240..cd5501eaf 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh @@ -50,7 +50,7 @@ fi # encrypted with the old keystore becomes unreadable. if ! kubectl -n "$ESIGNET_NS" get secret esignet-keystore-go-mosipid1 &>/dev/null; then echo "Generating dummy PKCS12 keystore for mosipid1" - DUMMY_P12_PASSWORD="$(openssl rand -hex 16)" + DUMMY_P12_PASSWORD="localtest" TMP_KEY="$(mktemp)" TMP_CERT="$(mktemp)" TMP_P12="$(mktemp)" From 63cf707c2f86bcc2cbbeab01f4bf55894c2df66c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 7 Aug 2026 17:10:37 +0530 Subject: [PATCH 19/20] fix: resolve CodeRabbit review findings on esignet-standalone-2.0.0 Correctness/security fixes: - helmsman_esignet.yml: use env.PROFILE (not the empty push-event input) in the MOSIP DSF check condition - helmsman_esignet.yml, helmsman_testrigs.yml: enforce mosipid1_domain_name/ mosipid2_domain_name as required instead of silently accepting empty values - helmsman_testrigs.yml: bind workflow inputs to env: and reference them as shell variables instead of interpolating ${{ }} directly into the script body (GitHub Actions script injection hardening) - esignet-misp-onboarder-postinstall.sh: always restore Istio injection before returning, exit nonzero on job failure instead of continuing to restart dependent workloads, stop masking rollout-status failures - esignet-misp-onboarder-preinstall.sh: add an EXIT trap to restore Istio injection if the hook fails partway, so a failed preinstall doesn't leave the namespace permanently without sidecar injection - kernel-preinstall.sh: validate MOSIP_API_HOST/MOSIP_API_INTERNAL_HOST before creating the domain-config configmap instead of silently defaulting to empty - softhsm-esignet-postinstall.sh: fix the copied configmap name (esignet-softhsm-share -> esignet-softhsm-go-share, matching what the mosip/softhsm chart actually creates) and stop suppressing copy failures - signup-service-preinstall.sh: restart the captcha deployment when the signup-go secret is updated on an existing deployment, not just on first creation, so key/secret rotations actually take effect - trigger-test-jobs-esignet.sh: distinguish genuine NotFound from other kubectl failures (RBAC, credentials, API errors) in the CronJob existence check, CronJob list, and Job status polling; separate local declarations from command-substitution assignments so exit codes are captured correctly; propagate signup/signup-go job failures into OVERALL_SUCCESS instead of discarding them - 4x apitestrig-esignet-*-setup.sh: create the s3-esignet-*-apitestrig and apitestrig-esignet-*-apitestrig secrets referenced by extraEnvVarsSecret, which nothing was creating before - esignet-mosipid1/2-plugin-values-2-0-0.yaml: LOGGING_LEVEL DEBUG -> INFO Documentation/consistency fixes: - Replace stale "eSignet 1.7.1" banners/headers with "eSignet Standalone 2.0.0" across hook scripts, and correct documented env var defaults to match code - esignet-dsf.yaml, testrigs-dsf.yaml: correct stale v1.7.1 references in comments and a commented-out postInstall path - captcha-postinstall.sh: fix header docs to match the actual env var names and default namespace - aws.tfvars: close an unclosed placeholder - Remove stray trailing blank lines / extra blank lines in two values files - ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: fix markdownlint MD028/MD029/MD031 violations, correct the Steps 2/4 profile-acceptance note, remove unconditional signup CronJob verification commands (Step 3 isn't ready for either profile), and extend the MOSIP-ID2 allowed-domain-uris example to cover shared MOSIP-ID2 environments Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 11 ++- .github/workflows/helmsman_testrigs.yml | 23 +++++- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 8 +- .../testrigs-dsf.yaml | 14 ++-- .../apitestrig-esignet-mosipid1-setup.sh | 22 ++++-- .../apitestrig-esignet-mosipid2-setup.sh | 22 ++++-- .../apitestrig-esignet-setup.sh | 22 ++++-- .../apitestrig-esignet-sunbird-setup.sh | 22 ++++-- .../captcha-postinstall.sh | 6 +- .../esignet-misp-onboarder-postinstall.sh | 20 +++-- .../esignet-misp-onboarder-preinstall.sh | 8 ++ .../kernel-preinstall.sh | 9 +++ .../mock-identity-init-db.sh | 6 +- .../mock-identity-system-preinstall.sh | 8 +- ...lying-party-service-mosipid1-preinstall.sh | 2 +- ...lying-party-service-mosipid2-preinstall.sh | 2 +- .../mock-relying-party-service-preinstall.sh | 4 +- ...elying-party-service-sunbird-preinstall.sh | 2 +- ...ck-relying-party-ui-mosipid1-preinstall.sh | 4 +- ...ck-relying-party-ui-mosipid2-preinstall.sh | 4 +- .../mock-relying-party-ui-preinstall.sh | 4 +- ...ock-relying-party-ui-sunbird-preinstall.sh | 4 +- .../notifier-postinstall.sh | 4 +- .../oidc-ui-mosipid1-preinstall.sh | 2 +- .../signup-service-preinstall.sh | 4 +- .../softhsm-esignet-postinstall.sh | 10 +-- .../trigger-test-jobs-esignet.sh | 76 +++++++++++++++---- .../uitestrig-signup-setup.sh | 6 +- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 2 +- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 3 +- .../esignet-plugin-values-2-0-0.yaml | 1 - docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 35 +++++---- .../profiles/esignet-standalone/aws.tfvars | 2 +- 33 files changed, 257 insertions(+), 115 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 170fb368f..d09e8d959 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -94,6 +94,15 @@ jobs: if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" + if [ -z "$MOSIPID1_DOMAIN" ]; then + echo "❌ mosipid1_domain_name is required for standalone profiles" + exit 1 + fi + if [ "${{ github.event.inputs.enable_mosipid2 }}" = "true" ] && + [ -z "$MOSIPID2_DOMAIN" ]; then + echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" + exit 1 + fi echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" MOSIPID1_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }}" @@ -326,7 +335,7 @@ jobs: kubectl cluster-info - name: Check if mosip-dsf label is completed - if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(github.event.inputs.profile, 'esignet-standalone') }} + if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(env.PROFILE, 'esignet-standalone') }} run: | STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.mosip-dsf}' 2>/dev/null || echo "") if [[ "$STATUS" != "completed" ]]; then diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 8a2c5395b..1b19de8ff 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -73,6 +73,12 @@ jobs: name: ${{ github.ref_name }} steps: - name: Validate required variables + env: + IN_MOSIPID1_DOMAIN: ${{ github.event.inputs.mosipid1_domain_name }} + IN_MOSIPID2_DOMAIN: ${{ github.event.inputs.mosipid2_domain_name }} + VAR_MOSIPID1_DOMAIN: ${{ vars.MOSIPID1_DOMAIN_NAME }} + VAR_MOSIPID2_DOMAIN: ${{ vars.MOSIPID2_DOMAIN_NAME }} + IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -100,13 +106,22 @@ jobs: # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. # Push events always target the esignet profile (path filter); dispatch uses explicit profile input. if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then - MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" - MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" + MOSIPID1_DOMAIN="${IN_MOSIPID1_DOMAIN:-$VAR_MOSIPID1_DOMAIN}" + MOSIPID2_DOMAIN="${IN_MOSIPID2_DOMAIN:-$VAR_MOSIPID2_DOMAIN}" + if [ -z "$MOSIPID1_DOMAIN" ]; then + echo "❌ mosipid1_domain_name is required for standalone profiles" + exit 1 + fi + if [ "$IN_ENABLE_MOSIPID2" = "true" ] && + [ -z "$MOSIPID2_DOMAIN" ]; then + echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" + exit 1 + fi echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" else - MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" - MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" + MOSIPID1_PROVIDED="$IN_MOSIPID1_DOMAIN" + MOSIPID2_PROVIDED="$IN_MOSIPID2_DOMAIN" if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" fi diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 9ce3a8826..0deca2876 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -1,19 +1,19 @@ # ============================================================================= # eSignet Profile - eSignet Services DSF (Desired State File) # ============================================================================= -# This DSF deploys eSignet v1.7.1 services for the standalone eSignet profile. +# This DSF deploys eSignet 2.0.0 (Go) services for the standalone eSignet profile. # # Components (in priority order): # 1. Keycloak Init (eSignet-specific clients and roles) -# 2. eSignet service v1.7.1 -# 3. OIDC UI v1.7.1 +# 2. eSignet service 2.0.0-develop (Go) +# 3. OIDC UI 2.0.0-develop (Go) # 4. Mock Identity System (optional, disabled by default) # 5. Mock Relying Party Service (optional) # 6. Mock Relying Party UI (optional) # 7. Partner Onboarder (eSignet + Resident OIDC) # 8. Demo OIDC Partner Onboarder # -# Based on eSignet v1.7.1 deploy scripts: +# Based on eSignet 2.0.0 deploy scripts: # - install-esignet.sh # - initialise-prereq.sh (keycloak-init) # ============================================================================= diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index f243acad9..b48741524 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -8,12 +8,12 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): -# esignet-apitestrig → esignet ns -# esignet-mosipid1-apitestrig → esignet-mosipid1 ns -# esignet-mosipid2-apitestrig → esignet-mosipid2 ns -# esignet-sunbird-apitestrig → esignet-sunbird ns -# esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) -# signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) +# esignet-apitestrig-go → esignet-go-mock ns +# esignet-go-mosipid1-apitestrig → esignet-go-mosipid1 ns +# esignet-go-mosipid2-apitestrig → esignet-go-mosipid2 ns +# esignet-go-sunbird-apitestrig → esignet-go-sunbird ns +# esignet-signup-apitestrig-go → signup-go ns (disabled — enable if signup deployed) +# signup-uitestrig-go → signup-uitestrig-go (disabled — enable if signup deployed) namespaces: esignet-go-mosipid1: protected: false @@ -212,7 +212,7 @@ apps: priority: -2 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh" - # postInstall: "$WORKDIR/hooks/esignet-standalone/trigger-test-jobs-esignet.sh" + # postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh" # --------------------------------------------------------------------------- # Signup API Test Rig — disabled by default diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh index adbdcadfb..14b70b216 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release. +# Prepares the esignet-mosipid1 namespace for the esignet-go-mosipid1-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-mosipid1-apitestrig / apitestrig-esignet-mosipid1-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-mosipid1 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-mosipid1-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-mosipid1-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-mosipid1-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid1-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh index bb5f2d9e2..072faec92 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release. +# Prepares the esignet-mosipid2 namespace for the esignet-go-mosipid2-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-mosipid2-apitestrig / apitestrig-esignet-mosipid2-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-mosipid2 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-mosipid2-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-mosipid2-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-mosipid2-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid2-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh index de0fb532e..ebd79e8e9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mock namespace for the esignet-apitestrig release. +# Prepares the esignet-mock namespace for the esignet-apitestrig-go release. # keycloak-host and keycloak-client-secrets are already present in esignet-mock ns -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-apitestrig / apitestrig-esignet-apitestrig secrets referenced +# by extraEnvVarsSecret are created here (chart doesn't create them itself); stale +# testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-mock COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh index 1a58942ea..d7adbcca9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-sunbird namespace for the esignet-sunbird-apitestrig release. +# Prepares the esignet-sunbird namespace for the esignet-go-sunbird-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-sunbird -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-sunbird-apitestrig / apitestrig-esignet-sunbird-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-sunbird COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-sunbird-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-sunbird-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-sunbird-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-sunbird-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh index 938217c8c..60ef72d59 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh @@ -7,9 +7,9 @@ # with the secret key environment variable. # # Environment Variables: -# CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) -# CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) -# ESIGNET_NS - eSignet namespace (default: esignet) +# ESIGNET_CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) +# ESIGNET_CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) +# ESIGNET_NS - eSignet namespace (default: esignet-go-mock) # ============================================================================= set -euo pipefail diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index bfeb5c619..f26e8ed56 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -18,23 +18,22 @@ JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ -l app.kubernetes.io/instance=esignet-misp-onboarder-go \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") -if [ "$JOB_STATUS" = "1" ]; then - echo "eSignet MISP partner onboarding completed successfully." -else +# Always restore namespace injection before returning from this hook. +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite +echo "Istio injection re-enabled on namespace $ESIGNET_NS." + +if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then echo "WARNING: onboarding job may not have completed. Check logs:" kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder-go --tail=30 2>/dev/null || true + exit 1 fi - -# Re-enable Istio sidecar injection now that the Job has completed -kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite -echo "Istio injection re-enabled on namespace $ESIGNET_NS." +echo "eSignet MISP partner onboarding completed successfully." # Restart config-server first so it reloads the MISP key from the secret, # then restart esignet so it fetches the updated config from config-server. if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server-go &>/dev/null; then kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server-go - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s || \ - echo "WARNING: esignet-config-server-go rollout did not complete within timeout." >&2 + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s echo "esignet-config-server-go restarted." else echo "esignet-config-server-go deployment not found — skipping restart." @@ -42,8 +41,7 @@ fi if kubectl -n "$ESIGNET_NS" get deployment esignet-go-mock &>/dev/null; then kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-go-mock - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s || \ - echo "WARNING: esignet rollout did not complete within timeout." >&2 + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s echo "esignet deployment restarted." else echo "esignet deployment not found — skipping restart." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh index 72baca851..e8dc9d7e8 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -26,6 +26,14 @@ kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply kubectl label namespace "$ESIGNET_NS" istio-injection=disabled --overwrite echo "Istio injection disabled on namespace $ESIGNET_NS." +restore_istio_injection_on_failure() { + local status=$? + if [ "$status" -ne 0 ]; then + kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite || true + fi +} +trap restore_istio_injection_on_failure EXIT + # Delete stale MISP onboarder artifacts from any previous run kubectl -n "$ESIGNET_NS" delete configmap esignet-onboarder-config --ignore-not-found=true kubectl -n "$ESIGNET_NS" delete secret esignet-onboarder-secrets --ignore-not-found=true diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh index 5651ce2b5..b4f4546ab 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh @@ -20,6 +20,15 @@ API_HOST="${MOSIP_API_HOST:-}" API_INTERNAL_HOST="${MOSIP_API_INTERNAL_HOST:-}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +if [ -z "$API_HOST" ]; then + echo "ERROR: MOSIP_API_HOST must be set" >&2 + exit 1 +fi +if [ -z "$API_INTERNAL_HOST" ]; then + echo "ERROR: MOSIP_API_INTERNAL_HOST must be set" >&2 + exit 1 +fi + echo "================================================" echo "eSignet 1.7.1 - Kernel Pre-install" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh index 9d22608cd..8f006956d 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh @@ -1,13 +1,13 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Identity System DB Init Pre-install +# eSignet Standalone 2.0.0 - Mock Identity System DB Init Pre-install # ============================================================================= # Based on: esignet-mock-services/deploy/postgres/init_db.sh # Ensures postgres-postgresql secret is present in the esignet namespace # before postgres-init-mock-identity helm chart runs DB initialization. # # Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet) +# ESIGNET_NS - eSignet namespace (default: esignet-go-mock) # ============================================================================= set -euo pipefail @@ -16,7 +16,7 @@ POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Mock Identity DB Init Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Identity DB Init Pre-install" echo "================================================" # --- Step 1: Ensure esignet namespace exists with istio --- diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh index da1b91802..4d51968bf 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Identity System Pre-install +# eSignet Standalone 2.0.0 - Mock Identity System Pre-install # ============================================================================= # Prepares esignet namespace for mock identity system deployment: # - Copies softhsm-mock-identity-system secret from softhsm ns @@ -8,8 +8,8 @@ # - Verifies softhsm-mock-identity-system-go-share ConfigMap is present # # Environment Variables: -# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem) -# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser) +# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem_go) +# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser_go) # MOCKID_DB_PORT - Postgres port (default: 5432) # ============================================================================= set -euo pipefail @@ -22,7 +22,7 @@ MOCKID_DB_PORT="${MOCKID_DB_PORT:-5432}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Mock Identity System Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Identity System Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh index 1847d2e5a..78db8d94c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID1 Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh index 069f92439..e6e8f3496 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID2 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID2 Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh index 45b51adcd..f2736d682 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install # ============================================================================= # Creates K8s secrets for mock relying party private keys from GitHub Actions # environment secrets, then verifies the esignet service is running. @@ -25,7 +25,7 @@ cleanup_temp_files() { trap cleanup_temp_files EXIT INT TERM echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party Service Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh index 7cb2fcbb6..74bc76ee2 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service Sunbird Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service Sunbird Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh index dd6165071..eccf10272 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install # ============================================================================= # Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service # is available in the esignet-mosipid1 namespace before UI deployment. @@ -10,7 +10,7 @@ set -euo pipefail ESIGNET_NS="esignet-go-mosipid1" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh index 3734187c8..3c65bbbcc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install # ============================================================================= # Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service # is available in the esignet-mosipid2 namespace before UI deployment. @@ -10,7 +10,7 @@ set -euo pipefail ESIGNET_NS="esignet-go-mosipid2" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh index 1340a045f..220b444ae 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh @@ -1,13 +1,13 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install # ============================================================================= # Prepares for mock relying party UI deployment. # ============================================================================= set -euo pipefail echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install" echo "================================================" # Ensure esignet namespace exists diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh index e1c066e06..9d37c849f 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install # ============================================================================= # Ensures esignet-sunbird namespace exists and verifies mock-relying-party-service # is available in the esignet-sunbird namespace before UI deployment. @@ -10,7 +10,7 @@ set -euo pipefail ESIGNET_NS="esignet-go-sunbird" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh index 8277b1a8f..5bf32602a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Notifier Post-install +# eSignet Standalone 2.0.0 - Notifier Post-install # ============================================================================= # Based on: esignet-signup/deploy/kernel/install.sh # Patches notifier deployment with SMS number length env vars after install. @@ -10,7 +10,7 @@ set -euo pipefail KERNEL_NS="kernel-go" echo "================================================" -echo "eSignet 1.7.1 - Notifier Post-install" +echo "eSignet Standalone 2.0.0 - Notifier Post-install" echo "================================================" # Source: deploy/kernel/install.sh - kubectl set env deployment/notifier diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh index fb19d5533..57aa055fa 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - OIDC UI MOSIPID1 Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. # ============================================================================= diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh index 84be8071d..1b95fc1e7 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh @@ -64,7 +64,9 @@ if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n captcha captcha --type='json' \ -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO", "valueFrom": {"secretKeyRef": {"name": "signup-captcha-go", "key": "signup-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO already exists." + echo "Restarting captcha to load the updated signup-go secret." + kubectl -n captcha rollout restart deployment/captcha + kubectl -n captcha rollout status deployment/captcha --timeout=480s fi # --- Step 5: Create signup-keystore secrets --- diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh index 2d02ce0cd..2818214bc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh @@ -25,14 +25,12 @@ echo "Waiting for SoftHSM pod to be ready..." kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm-go --timeout=480s || \ { echo "ERROR: SoftHSM pod not ready after timeout" >&2; exit 1; } -# --- Step 2: Copy esignet-softhsm-share configmap to esignet namespace --- -echo "Copying esignet-softhsm-share configmap to $ESIGNET_NS namespace" -$COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ - echo "WARNING: esignet-softhsm-share configmap not found in $SOFTHSM_NS" +# --- Step 2: Copy esignet-softhsm-go-share configmap to esignet namespace --- +echo "Copying esignet-softhsm-go-share configmap to $ESIGNET_NS namespace" +$COPY_UTIL configmap esignet-softhsm-go-share "$SOFTHSM_NS" "$ESIGNET_NS" # --- Step 3: Copy esignet-softhsm secret to esignet namespace --- echo "Copying esignet-softhsm-go secret to $ESIGNET_NS namespace" -$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ - echo "WARNING: esignet-softhsm-go secret not found in $SOFTHSM_NS" +$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM eSignet post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh index 58088c891..99884df6b 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh @@ -1,11 +1,11 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Trigger Testrig CronJobs +# eSignet Standalone 2.0.0 - Trigger Testrig CronJobs # ============================================================================= # Immediately triggers testrig CronJobs after deployment: -# apitestrig → esignet-mock ns (cronjob-apitestrig-esignet-mock) -# signup-apitestrig → signup ns (if deployed) -# signup-uitestrig → signup-uitestrig ns (if deployed) +# apitestrig → esignet-go-mock ns +# signup-apitestrig → signup-go ns (if deployed) +# signup-uitestrig → signup-uitestrig-go ns (if deployed) # ============================================================================= set -euo pipefail @@ -13,12 +13,35 @@ CONTINUE_ON_FAILURE="${CONTINUE_ON_FAILURE:-true}" JOB_TIMEOUT="${JOB_TIMEOUT:-5400}" OVERALL_SUCCESS=true +# Runs `kubectl "$@"`, printing stdout on success. +# Returns 0 on success, 2 for a genuine NotFound (caller should treat the +# resource as absent), or 1 with the error printed to stderr for any other +# kubectl failure (RBAC, credentials, API errors) so real problems aren't +# silently swallowed alongside the expected "doesn't exist" case. +kubectl_get() { + local output rc=0 + output=$(kubectl "$@" 2>&1) || rc=$? + if [[ $rc -eq 0 ]]; then + printf '%s' "$output" + return 0 + fi + if echo "$output" | grep -q '(NotFound)'; then + return 2 + fi + echo "✗ kubectl $* failed: $output" >&2 + return 1 +} + trigger_and_wait() { local ns=$1 cronjob=$2 - if ! kubectl get cronjob -n "$ns" "$cronjob" &>/dev/null; then + local rc=0 + kubectl_get get cronjob -n "$ns" "$cronjob" -o name >/dev/null || rc=$? + if [[ $rc -eq 2 ]]; then echo "⏭ CronJob $cronjob not found in $ns — skipping" return 0 + elif [[ $rc -ne 0 ]]; then + return 1 fi local job_name="${cronjob}-manual-$(date +%s)" @@ -27,10 +50,29 @@ trigger_and_wait() { local elapsed=0 while [[ $elapsed -lt $JOB_TIMEOUT ]]; do - local complete=$(kubectl get job -n "$ns" "$job_name" \ - -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}' 2>/dev/null || echo "") - local failed=$(kubectl get job -n "$ns" "$job_name" \ - -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}' 2>/dev/null || echo "") + local complete failed + rc=0 + complete=$(kubectl_get get job -n "$ns" "$job_name" \ + -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo " ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..." + sleep 10 + elapsed=$((elapsed + 10)) + continue + elif [[ $rc -ne 0 ]]; then + return 1 + fi + rc=0 + failed=$(kubectl_get get job -n "$ns" "$job_name" \ + -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo " ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..." + sleep 10 + elapsed=$((elapsed + 10)) + continue + elif [[ $rc -ne 0 ]]; then + return 1 + fi [[ "$complete" == "True" ]] && { echo "✓ $job_name completed successfully"; return 0; } [[ "$failed" == "True" ]] && { echo "✗ $job_name failed" >&2 @@ -48,8 +90,14 @@ trigger_and_wait() { trigger_all_in_ns() { local ns=$1 - local cronjobs - cronjobs=$(kubectl get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "") + local cronjobs rc=0 + cronjobs=$(kubectl_get get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo "⏭ No CronJobs found in $ns — skipping" + return 0 + elif [[ $rc -ne 0 ]]; then + return 1 + fi if [[ -z "$cronjobs" ]]; then echo "⏭ No CronJobs found in $ns — skipping" return 0 @@ -60,7 +108,7 @@ trigger_all_in_ns() { } echo "================================================" -echo "eSignet 1.7.1 - Trigger Testrig CronJobs" +echo "eSignet Standalone 2.0.0 - Trigger Testrig CronJobs" echo "================================================" echo "=== eSignet API Testrig (esignet-go-mock ns) ===" @@ -76,10 +124,10 @@ echo "=== eSignet-Sunbird API Testrig (esignet-go-sunbird ns) ===" trigger_all_in_ns esignet-go-sunbird || OVERALL_SUCCESS=false echo "=== Signup API Testrig (signup-go ns, if deployed) ===" -trigger_all_in_ns signup-go || true +trigger_all_in_ns signup-go || OVERALL_SUCCESS=false echo "=== Signup UI Testrig (signup-uitestrig-go ns, if deployed) ===" -trigger_all_in_ns signup-uitestrig-go || true +trigger_all_in_ns signup-uitestrig-go || OVERALL_SUCCESS=false echo "" echo "=== Testrig Execution Summary ===" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh index c4f7ccf45..102ff6a9c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh @@ -1,8 +1,8 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Signup UI Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install Setup # ============================================================================= -# Prepares the signup-uitestrig namespace. +# Prepares the signup-uitestrig-go namespace. # Copies keycloak resources from keycloak ns, MinIO s3 secret from minio ns, # and postgres-postgresql from postgres ns. # Stale uitestrig CMs are deleted so the chart recreates them from set: values. @@ -13,7 +13,7 @@ NS=signup-uitestrig-go COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Signup UI Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install" echo "================================================" echo "Ensuring $NS namespace exists with Istio injection disabled" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 409283736..7a48edd8f 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -135,7 +135,7 @@ extraEnvVarsAdditional: 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG + value: INFO - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED value: "false" - name: MOSIP_ESIGNET_CAPTCHA_URL diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 7c4890e12..9e5695a8e 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -135,7 +135,7 @@ extraEnvVarsAdditional: 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG + value: INFO - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED value: "" - name: MOSIP_ESIGNET_CAPTCHA_URL @@ -145,4 +145,3 @@ extraEnvVarsAdditional: secretKeyRef: name: esignet-misp-onboarder-key key: mosip-esignet-misp-key - diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index 83c8dbd6c..b10407528 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -117,7 +117,6 @@ extraEnvVars: # prefix: /v1/esignet/ - # extraEnvVarsAdditional is a Helm list — this file REPLACES the base list on merge. # All required entries (captcha + plugin-specific) must be present together. diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 4340b2245..49bdb12ca 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -180,7 +180,7 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | > ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. - +> > **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0` > — there are no separate `_GO`-suffixed GitHub secrets. Internally, the 2.0.0 hooks create differently-named > Kubernetes secrets (e.g. `esignet-captcha-go`, `esignet-captcha-go-mosipid1`) and patch differently-named env @@ -236,9 +236,10 @@ Step 3 → Deploy Signup (helmsman_signup.yml) ⚠️ IN PROGR Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min profile: esignet-standalone or esignet-standalone-2.0.0 ``` -> Steps 2–4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy the -> Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both profiles -> share the same external infrastructure. +> Steps 2 and 4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy +> the Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both +> profiles share the same external infrastructure. Step 3's dropdown also lists `esignet-standalone-2.0.0`, +> but the step itself isn't usable yet for either profile — see the note below. --- @@ -356,9 +357,11 @@ Follow the full instructions in the root README: [Step 3ca: Observation Infrastr ![Deploy External Services - Helmsman](_images/helmsman-external-services.png) **How to know it succeeded:** Click into the running workflow. Wait for all jobs to show a green tick. Then run: + ```bash kubectl get pods -n postgres && kubectl get pods -n keycloak && kubectl get pods -n kafka ``` + All pods should show `Running` or `Completed`. --- @@ -390,6 +393,10 @@ All pods should show `Running` or `Completed`. > **Important:** Always tick `skip_mosip_dsf_check` for standalone eSignet — without it, the workflow waits for a `mosip-dsf=completed` namespace label that will never appear (there is no full MOSIP deployment in this mode), and the workflow will fail. +4. Click the green **`Run workflow`** button + +![Deploy eSignet - Helmsman](_images/esignet.png) + > **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml` > instead — it deploys the same 4 instances (main/mock, mosipid1, mosipid2, sunbird) plus their OIDC UIs and mock > relying party service, but into `-go`-suffixed namespaces (`esignet-go-mock`, `esignet-go-mosipid1`, @@ -398,13 +405,10 @@ All pods should show `Running` or `Completed`. > `esignet-standalone`. You can run both profiles side by side in the same cluster — Step 1 only needs to be run > once, with `profile: esignet-standalone`. -4. Click the green **`Run workflow`** button - -![Deploy eSignet - Helmsman](_images/esignet.png) - **How to know it succeeded:** For `esignet-standalone`: + ```bash kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird # If enable_mosipid2 was set to true: @@ -412,6 +416,7 @@ kubectl get pods -n esignet-mosipid2 ``` For `esignet-standalone-2.0.0`: + ```bash kubectl get pods -n esignet-go-mock && kubectl get pods -n esignet-go-mosipid1 && kubectl get pods -n esignet-go-sunbird # If enable_mosipid2 was set to true: @@ -469,21 +474,21 @@ All pods should show `Running`. **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created: For `esignet-standalone`: + ```bash kubectl get cronjobs -n esignet-mock kubectl get cronjobs -n esignet-mosipid1 kubectl get cronjobs -n esignet-mosipid2 kubectl get cronjobs -n esignet-sunbird -kubectl get cronjobs -n signup ``` For `esignet-standalone-2.0.0`: + ```bash kubectl get cronjobs -n esignet-go-mock kubectl get cronjobs -n esignet-go-mosipid1 kubectl get cronjobs -n esignet-go-mosipid2 kubectl get cronjobs -n esignet-go-sunbird -kubectl get cronjobs -n signup-go ``` --- @@ -564,11 +569,13 @@ Reference commit: [mosip/mosip-config@e8961a2](https://github.com/mosip/mosip-co The MOSIP Identity Authentication service restricts which domains can call its APIs. Edit `id-authentication-default.properties` in the MOSIP platform's `mosip-config` branch and add your eSignet standalone hostnames to `mosip.ida.allowed.domain.uris`: **For mosipid1 only:** + ```properties mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1. ``` **For both mosipid1 and mosipid2:** + ```properties mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-mosipid2. ``` @@ -577,11 +584,13 @@ Replace `` with your eSignet standalone base domain (e.g. `sandbox. > **`esignet-standalone-2.0.0` note:** Since `MOSIPID1_DOMAIN_NAME`/`MOSIPID2_DOMAIN_NAME` are shared between both > profiles (see [Section 0](#0-understanding-the-esignet-instances)), if you're running `esignet-mosipid1` (v1.7.1) -> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment, add **both** hostnames to -> `mosip.ida.allowed.domain.uris`: +> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment (and similarly for +> MOSIP-ID2), add **both** hostnames for each shared environment to `mosip.ida.allowed.domain.uris`: +> > ```properties -> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1. +> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1.,https://esignet-mosipid2.,https://esignet-go-mosipid2. > ``` +> > Otherwise, only add the hostname for whichever profile(s) you actually deployed. Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index a7cfa4290..98b68ff23 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -13,7 +13,7 @@ cluster_name = "" cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = " Date: Fri, 7 Aug 2026 17:50:36 +0530 Subject: [PATCH 20/20] fix: bind enable_mosipid2 to env in helmsman_esignet.yml, guard mosipid2 cronjob checks in docs - helmsman_esignet.yml: bind github.event.inputs.enable_mosipid2 to a step-level env var in the validate-inputs job's "Validate required variables" step instead of interpolating ${{ }} directly into the shell condition (same script-injection hardening pattern already applied to helmsman_testrigs.yml) - ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: make the esignet-mosipid2 / esignet-go-mosipid2 CronJob verification commands conditional on enable_mosipid2, matching the pattern already used for the pods-check section earlier in the guide Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 4 +++- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 6 ++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index d09e8d959..f2753edf1 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -71,6 +71,8 @@ jobs: name: ${{ github.ref_name }} steps: - name: Validate required variables + env: + IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -98,7 +100,7 @@ jobs: echo "❌ mosipid1_domain_name is required for standalone profiles" exit 1 fi - if [ "${{ github.event.inputs.enable_mosipid2 }}" = "true" ] && + if [ "$IN_ENABLE_MOSIPID2" = "true" ] && [ -z "$MOSIPID2_DOMAIN" ]; then echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" exit 1 diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 49bdb12ca..8d8e29d8d 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -478,8 +478,9 @@ For `esignet-standalone`: ```bash kubectl get cronjobs -n esignet-mock kubectl get cronjobs -n esignet-mosipid1 -kubectl get cronjobs -n esignet-mosipid2 kubectl get cronjobs -n esignet-sunbird +# If enable_mosipid2 was set to true: +kubectl get cronjobs -n esignet-mosipid2 ``` For `esignet-standalone-2.0.0`: @@ -487,8 +488,9 @@ For `esignet-standalone-2.0.0`: ```bash kubectl get cronjobs -n esignet-go-mock kubectl get cronjobs -n esignet-go-mosipid1 -kubectl get cronjobs -n esignet-go-mosipid2 kubectl get cronjobs -n esignet-go-sunbird +# If enable_mosipid2 was set to true: +kubectl get cronjobs -n esignet-go-mosipid2 ``` ---