Skip to content

Commit 7c4f456

Browse files
bscholtes1Abscholtes1A
committed
Merge pull request #3 from AmadeusITGroup/chore/bump_eonax_0.2.0
chore: bump eonax version to 0.2.0
2 parents e30fb73 + 844f71d commit 7c4f456

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

62 files changed

+1431
-1957
lines changed

‎.github/workflows/deploy-connector.yaml

+186
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
name: Deploy Connector
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
paths:
9+
- 'deployment/**'
10+
pull_request:
11+
paths:
12+
- 'deployment/**'
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
19+
Deploy-Connector:
20+
defaults:
21+
run:
22+
working-directory: ./deployment
23+
24+
env:
25+
CLUSTER_NAME: eonax-cluster
26+
DID_WEB: did:web:localhost:ih:did
27+
permissions:
28+
checks: write
29+
runs-on: ubuntu-latest
30+
steps:
31+
- uses: actions/checkout@v4
32+
with:
33+
token: ${{ secrets.CICD_TOKEN }}
34+
35+
- name: 'Setup Terraform'
36+
uses: hashicorp/[email protected]
37+
with:
38+
terraform_version: 1.6.0
39+
terraform_wrapper: false
40+
41+
- name: 'Create Kubernetes cluster'
42+
uses: helm/[email protected]
43+
with:
44+
cluster_name: ${{ env.CLUSTER_NAME }}
45+
config: kind.config.yaml
46+
47+
- name: 'Create Ingress Controller'
48+
shell: bash
49+
run: |
50+
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
51+
kubectl wait \
52+
--namespace ingress-nginx \
53+
--for=condition=ready pod \
54+
--selector=app.kubernetes.io/component=controller \
55+
--timeout=90s
56+
57+
- name: 'Install Vault and DB'
58+
working-directory: ./deployment/storage
59+
shell: bash
60+
run: |
61+
terraform init
62+
terraform apply -auto-approve
63+
64+
- name: 'Login to Docker registry'
65+
uses: docker/login-action@v3
66+
with:
67+
username: ${{ secrets.DOCKER_USERNAME }}
68+
password: ${{ secrets.DOCKER_TOKEN }}
69+
70+
- name: 'Pull Docker images and Helm charts'
71+
working-directory: ./deployment/connector
72+
shell: bash
73+
run: |
74+
for i in control-plane data-plane identity-hub; do \
75+
image=eonax-$i-postgresql-hashicorpvault; \
76+
77+
## pull the Docker image
78+
docker pull ${{ vars.DOCKER_REPO }}/$image:${{ vars.EONAX_VERSION }}; \
79+
## tag image with version latest
80+
docker tag ${{ vars.DOCKER_REPO }}/$image:${{ vars.EONAX_VERSION }} $image:latest; \
81+
## load image to the cluster
82+
kind load docker-image $image:latest --name ${{ env.CLUSTER_NAME }}; \
83+
84+
## pull Helm charts
85+
chart=${i//-/}; \
86+
helm pull ${{ vars.HELM_REPO }}/$chart --version ${{ vars.EONAX_VERSION }}; \
87+
mv $chart-${{ vars.EONAX_VERSION }}.tgz $chart.tgz; \
88+
done
89+
90+
- name: 'Download SQL files'
91+
shell: bash
92+
working-directory: ./deployment/connector
93+
run: |
94+
jq -r --arg version "${{ vars.EDC_VERSION }}" '.files[] | "https://raw.githubusercontent.com/eclipse-edc/\(.repo)/\($version)/\(.path)/src/main/resources/\(.file_name)"' sql.json | \
95+
tr -d '\r' | \
96+
while read -r url; do curl -o "./connector/sql/$(basename "$url")" "$url"; done
97+
98+
- name: 'Install connector'
99+
shell: bash
100+
working-directory: ./deployment/connector
101+
run: |
102+
terraform init
103+
terraform apply -auto-approve
104+
105+
- name: 'Generate keys'
106+
shell: bash
107+
run: |
108+
openssl genpkey -algorithm RSA -out private-key.pem -pkeyopt rsa_keygen_bits:2048 && \
109+
openssl rsa -pubout -in private-key.pem -out public-key.pem && \
110+
for k in public-key private-key; do VAULT_TOKEN=root VAULT_ADDR=http://localhost/vault vault kv put secret/$k content=@$k.pem; done
111+
112+
- name: 'Create participant context'
113+
shell: bash
114+
env:
115+
IH_RESOLUTION_URL: http://localhost/ih/resolution
116+
CP_DSP_URL: http://localhost/cp/dsp
117+
run: |
118+
didBase64Url=$(echo -n "$DID_WEB" | base64 | tr '+/' '-_' | tr -d '=')
119+
120+
curl -X POST -H "Content-Type: application/json" -d "$(cat <<EOF
121+
{
122+
"participantId": "${{ env.DID_WEB }}",
123+
"did": "${{ env.DID_WEB }}",
124+
"active": true,
125+
"key": {
126+
"keyId": "my-key",
127+
"privateKeyAlias": "private-key",
128+
"publicKeyPem": "$(awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' public-key.pem)"
129+
},
130+
"serviceEndpoints": [
131+
{
132+
"id": "credential-service-url",
133+
"type": "CredentialService",
134+
"serviceEndpoint": "$IH_RESOLUTION_URL/v1/participants/$didBase64Url"
135+
},
136+
{
137+
"id": "dsp-url",
138+
"type": "DSPMessaging",
139+
"serviceEndpoint": "$CP_DSP_URL"
140+
}
141+
]
142+
}
143+
EOF
144+
)" http://localhost/ih/identity/v1alpha/participants
145+
146+
- name: 'Add membership VC'
147+
shell: bash
148+
run: |
149+
didBase64Url=$(echo -n "$DID_WEB" | base64 | tr '+/' '-_' | tr -d '=')
150+
151+
curl -X POST -H "Content-Type: application/json" -d "$(cat <<EOF
152+
{
153+
"participantId": "${{ env.DID_WEB }}",
154+
"verifiableCredentialContainer": {
155+
"rawVc": "eyJraWQiOiJkaWQ6d2ViOmF1dGhvcml0eS1pZGVudGl0eWh1YiUzQTgzODM6YXBpOmRpZCNteS1rZXkiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmF1dGhvcml0eS1pZGVudGl0eWh1YiUzQTgzODM6YXBpOmRpZCIsInN1YiI6ImRpZDp3ZWI6cHJvdmlkZXItaWRlbnRpdHlodWIlM0E4MzgzOmFwaTpkaWQiLCJ2YyI6eyJjcmVkZW50aWFsU3ViamVjdCI6W3siaWQiOiJkaWQ6d2ViOnByb3ZpZGVyLWlkZW50aXR5aHViJTNBODM4MzphcGk6ZGlkIiwibmFtZSI6InByb3ZpZGVyIiwibWVtYmVyc2hpcCI6eyJtZW1iZXJzaGlwVHlwZSI6IkZ1bGxNZW1iZXIiLCJzaW5jZSI6IjIwMjMtMDEtMDFUMDA6MDA6MDBaIn19XSwiaWQiOiIzMTkxNWJjOC0wODhjLTQwZDYtYTAxNC03YTk4YmNkNzBiY2IiLCJ0eXBlIjpbIlZlcmlmaWFibGVDcmVkZW50aWFsIiwiTWVtYmVyc2hpcENyZWRlbnRpYWwiXSwiaXNzdWVyIjp7ImlkIjoiZGlkOndlYjphdXRob3JpdHktaWRlbnRpdHlodWIlM0E4MzgzOmFwaTpkaWQiLCJhZGRpdGlvbmFsUHJvcGVydGllcyI6e319LCJpc3N1YW5jZURhdGUiOiIyMDI0LTA4LTE0VDE0OjMzOjQwWiIsImV4cGlyYXRpb25EYXRlIjpudWxsLCJjcmVkZW50aWFsU3RhdHVzIjpbXSwiZGVzY3JpcHRpb24iOm51bGwsIm5hbWUiOm51bGx9LCJpYXQiOjE3MjM2NDYwMjB9.FD4vjPomuKusPdyWlMRcOgbzUhGC7kyliw6My6HFrQzdAcKGC6N_BW-Cg4pHAX4f2O4EhFn5WJr-uB2UaZOHlQ",
156+
"format": "JWT",
157+
"credential": {
158+
"credentialSubject": [
159+
{
160+
"id": "${{ env.DID_WEB }}",
161+
"name": "provider",
162+
"membership": {
163+
"membershipType": "FullMember",
164+
"since": "2023-01-01T00:00:00Z"
165+
}
166+
}
167+
],
168+
"id": "31915bc8-088c-40d6-a014-7a98bcd70bcb",
169+
"type": [
170+
"VerifiableCredential",
171+
"MembershipCredential"
172+
],
173+
"issuer": {
174+
"id": "did:web:eonax-authority-url:api:did",
175+
"additionalProperties": {}
176+
},
177+
"issuanceDate": "2024-08-14T14:33:40Z",
178+
"expirationDate": null,
179+
"credentialStatus": [],
180+
"description": null,
181+
"name": null
182+
}
183+
}
184+
}
185+
EOF
186+
)" http://localhost/ih/identity/v1alpha/participants/$didBase64Url/credentials

‎.github/workflows/terraform.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Terraform
33
on:
44
push:
55
branches:
6-
- master
6+
- main
77
paths:
88
- 'deployment/**'
99
pull_request:

‎.gitignore

+4-1
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,7 @@ hs_err_pid*
3636
## Helm stuff
3737
requirements.lock
3838
Chart.lock
39-
**/charts/
39+
**/charts/
40+
41+
# packages Helm charts
42+
*.tgz

‎deployment/connector/controlplane.tf

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
locals {
2+
controlplane_release_name = "controlplane"
3+
}
4+
5+
resource "helm_release" "controlplane" {
6+
name = local.controlplane_release_name
7+
cleanup_on_fail = true
8+
dependency_update = true
9+
recreate_pods = true
10+
chart = "./controlplane.tgz"
11+
12+
values = [
13+
yamlencode({
14+
"controlplane" : {
15+
"image" : {
16+
"repository" : "eonax-control-plane-postgresql-hashicorpvault"
17+
"tag" : "latest"
18+
"pullPolicy" : "Never"
19+
},
20+
"keys" : {
21+
"sts" : {
22+
"privateKeyVaultAlias" : var.private_key_alias,
23+
"publicKeyId" : "${var.identity_hub_did_web_url}#my-key"
24+
}
25+
},
26+
"did" : {
27+
"web" : {
28+
"url" : var.identity_hub_did_web_url
29+
"useHttps" : false
30+
}
31+
},
32+
33+
"url" : {
34+
"protocol" : var.control_plane_dsp_url
35+
},
36+
37+
"logging" : <<EOT
38+
.level=DEBUG
39+
org.eclipse.edc.level=ALL
40+
handlers=java.util.logging.ConsoleHandler
41+
java.util.logging.ConsoleHandler.formatter=java.util.logging.SimpleFormatter
42+
java.util.logging.ConsoleHandler.level=ALL
43+
java.util.logging.SimpleFormatter.format=[%1$tY-%1$tm-%1$td %1$tH:%1$tM:%1$tS] [%4$-7s] %5$s%6$s%n
44+
EOT
45+
46+
"config" : <<EOT
47+
edc.vault.hashicorp.token.scheduled-renew-enabled=false
48+
edc.negotiation.state-machine.iteration-wait-millis=${var.negotiation_state_machine_wait_millis}
49+
edc.transfer.state-machine.iteration-wait-millis=${var.transfer_state_machine_wait_millis}
50+
edc.policy.monitor.state-machine.iteration-wait-millis=${var.policy_monitor_state_machine_wait_millis}
51+
EOT
52+
53+
"ingress" : {
54+
"enabled" : true
55+
"className" : "nginx"
56+
"annotations" : {
57+
"nginx.ingress.kubernetes.io/ssl-redirect" : "false"
58+
"nginx.ingress.kubernetes.io/use-regex" : "true"
59+
"nginx.ingress.kubernetes.io/rewrite-target" : "/api/$1$2"
60+
},
61+
"endpoints" : [
62+
{
63+
"port" : 8181,
64+
"path" : "/cp/(management)(.*)"
65+
},
66+
{
67+
"port" : 8282,
68+
"path" : "/cp/(dsp)(.*)"
69+
}
70+
]
71+
},
72+
"postgresql" : {
73+
"jdbcUrl" : "jdbc:postgresql://${var.db_server_fqdn}/${var.db_name}",
74+
"credentials" : {
75+
"secret" : {
76+
"name" : kubernetes_secret.db-user-credentials.metadata.0.name
77+
}
78+
}
79+
},
80+
"vault" : {
81+
"hashicorp" : {
82+
"url" : var.vault_url
83+
"token" : {
84+
"secret" : {
85+
"name" : var.vault_token_secret_name
86+
}
87+
}
88+
}
89+
}
90+
}
91+
})
92+
]
93+
94+
depends_on = [module.db]
95+
}

‎deployment/connector/dataplane.tf

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
locals {
2+
dataplane_release_name = "dataplane"
3+
4+
dpf_selector_url = "http://${local.controlplane_release_name}:8383/api/control/v1/dataplanes"
5+
}
6+
7+
resource "helm_release" "dataplane" {
8+
name = local.dataplane_release_name
9+
cleanup_on_fail = true
10+
dependency_update = true
11+
recreate_pods = true
12+
chart = "./dataplane.tgz"
13+
14+
values = [
15+
yamlencode({
16+
"dataplane" : {
17+
"image" : {
18+
"repository" : "eonax-data-plane-postgresql-hashicorpvault"
19+
"tag" : "latest"
20+
"pullPolicy" : "Never"
21+
},
22+
"keys" : {
23+
// use the same key pair for simplicity
24+
"dataplane" : {
25+
"privateKeyVaultAlias" : var.private_key_alias,
26+
"publicKeyVaultAlias" : var.public_key_alias
27+
}
28+
}
29+
30+
"logging" : <<EOT
31+
.level=INFO
32+
org.eclipse.edc.level=ALL
33+
handlers=java.util.logging.ConsoleHandler
34+
java.util.logging.ConsoleHandler.formatter=java.util.logging.SimpleFormatter
35+
java.util.logging.ConsoleHandler.level=ALL
36+
java.util.logging.SimpleFormatter.format=[%1$tY-%1$tm-%1$td %1$tH:%1$tM:%1$tS] [%4$-7s] %5$s%6$s%n
37+
EOT
38+
39+
"config" : <<EOT
40+
edc.vault.hashicorp.token.scheduled-renew-enabled=false
41+
edc.dataplane.state-machine.iteration-wait-millis=${var.data_plane_state_machine_wait_millis}
42+
EOT
43+
"ingress" : {
44+
"enabled" : true
45+
"className" : "nginx"
46+
"annotations" : {
47+
"nginx.ingress.kubernetes.io/ssl-redirect" : "false"
48+
"nginx.ingress.kubernetes.io/use-regex" : "true"
49+
"nginx.ingress.kubernetes.io/rewrite-target" : "/api/$1$2"
50+
},
51+
"endpoints" : [
52+
{
53+
"port" : 8181,
54+
"path" : "/dp/(public)(.*)"
55+
},
56+
{
57+
"port" : 8282,
58+
"path" : "/dp/(data)(.*)"
59+
}
60+
]
61+
},
62+
63+
"selector" : {
64+
"url" : local.dpf_selector_url
65+
}
66+
67+
"url" : {
68+
"public" : var.data_plane_public_url
69+
},
70+
71+
"postgresql" : {
72+
"jdbcUrl" : "jdbc:postgresql://${var.db_server_fqdn}/${var.db_name}",
73+
"credentials" : {
74+
"secret" : {
75+
"name" : kubernetes_secret.db-user-credentials.metadata.0.name
76+
}
77+
}
78+
},
79+
"vault" : {
80+
"hashicorp" : {
81+
"url" : var.vault_url
82+
"token" : {
83+
"secret" : {
84+
"name" : var.vault_token_secret_name
85+
}
86+
}
87+
}
88+
}
89+
}
90+
})
91+
]
92+
93+
depends_on = [module.db, helm_release.controlplane]
94+
}

0 commit comments

Comments
 (0)