diff --git a/.github/workflows/helm-integration.yaml b/.github/workflows/helm-integration.yaml index 626f6a40..31246e28 100644 --- a/.github/workflows/helm-integration.yaml +++ b/.github/workflows/helm-integration.yaml @@ -44,7 +44,11 @@ jobs: run: helm lint charts/osac/ - name: Template chart (dry-run validation) - run: helm template osac charts/osac/ --values values/development.yaml > /dev/null + run: | + helm template osac charts/osac/ --values values/development.yaml \ + --set service.externalHostname=fulfillment-api.osac.svc.cluster.local \ + --set service.internalHostname=fulfillment-internal-api.osac.svc.cluster.local \ + > /dev/null - name: Deploy umbrella chart continue-on-error: true @@ -53,6 +57,8 @@ jobs: --namespace osac \ --create-namespace \ --values values/development.yaml \ + --set service.externalHostname=fulfillment-api.osac.svc.cluster.local \ + --set service.internalHostname=fulfillment-internal-api.osac.svc.cluster.local \ --set validation.enabled=false \ --set aap.bootstrap.enabled=false \ --set aap.aap.instance.enabled=false \ @@ -78,6 +84,8 @@ jobs: helm upgrade osac charts/osac/ \ --namespace osac \ --values values/development.yaml \ + --set service.externalHostname=fulfillment-api.osac.svc.cluster.local \ + --set service.internalHostname=fulfillment-internal-api.osac.svc.cluster.local \ --set validation.enabled=false \ --set aap.bootstrap.enabled=false \ --set aap.aap.instance.enabled=false \ diff --git a/.github/workflows/helm-lint.yaml b/.github/workflows/helm-lint.yaml index 710869e2..75ae02bf 100644 --- a/.github/workflows/helm-lint.yaml +++ b/.github/workflows/helm-lint.yaml @@ -45,7 +45,10 @@ jobs: set -euo pipefail for f in values/*.yaml; do echo "--- helm template with $(basename "$f") ---" - helm template osac charts/osac/ --values "$f" > /dev/null + helm template osac charts/osac/ --values "$f" \ + --set service.externalHostname=fulfillment-api.example.com \ + --set service.internalHostname=fulfillment-internal-api.example.com \ + > /dev/null done - name: Validate values schema diff --git a/charts/osac/ci/bundled-postgres-values.yaml b/charts/osac/ci/bundled-postgres-values.yaml index 802de396..83aa7f3f 100644 --- a/charts/osac/ci/bundled-postgres-values.yaml +++ b/charts/osac/ci/bundled-postgres-values.yaml @@ -6,6 +6,8 @@ bundledPostgres: user: service service: + externalHostname: fulfillment-api.example.com + internalHostname: fulfillment-internal-api.example.com auth: issuerUrl: https://keycloak.example.com/realms/osac controllerCredentials: diff --git a/charts/osac/ci/default-values.yaml b/charts/osac/ci/default-values.yaml index 0a7d3f48..1b265855 100644 --- a/charts/osac/ci/default-values.yaml +++ b/charts/osac/ci/default-values.yaml @@ -2,6 +2,8 @@ # Only sets values that subcharts mark as required. service: + externalHostname: fulfillment-api.example.com + internalHostname: fulfillment-internal-api.example.com auth: issuerUrl: https://keycloak.example.com/realms/osac controllerCredentials: diff --git a/charts/osac/ci/full-values.yaml b/charts/osac/ci/full-values.yaml index 9b55f56f..8c4585d3 100644 --- a/charts/osac/ci/full-values.yaml +++ b/charts/osac/ci/full-values.yaml @@ -13,6 +13,8 @@ operator: service: variant: openshift + externalHostname: fulfillment-api.example.com + internalHostname: fulfillment-internal-api.example.com auth: issuerUrl: https://keycloak.keycloak.svc.cluster.local/realms/osac controllerCredentials: diff --git a/charts/osac/ci/no-aap-values.yaml b/charts/osac/ci/no-aap-values.yaml index 05ac5ac6..765e3ce4 100644 --- a/charts/osac/ci/no-aap-values.yaml +++ b/charts/osac/ci/no-aap-values.yaml @@ -2,6 +2,8 @@ # Exercises the disabled-AAP template branches. service: + externalHostname: fulfillment-api.example.com + internalHostname: fulfillment-internal-api.example.com auth: issuerUrl: https://keycloak.example.com/realms/osac controllerCredentials: diff --git a/charts/osac/values-example.yaml b/charts/osac/values-example.yaml index 8e2ebac4..56915f30 100644 --- a/charts/osac/values-example.yaml +++ b/charts/osac/values-example.yaml @@ -101,6 +101,18 @@ service: # Deployment variant: "openshift" for OCP clusters, "kind" for local dev. variant: openshift + # [REQUIRED] Hostname used to access the public API from outside the cluster. + # This is the hostname for the OpenShift Route or Ingress that exposes the + # fulfillment API externally. + # Example: fulfillment-api-osac.apps.mycluster.example.com + externalHostname: "" + + # [REQUIRED] Hostname used to access both the public and private APIs + # internally. This Route/Ingress is typically not exposed to the internet + # and is used by other OSAC components (operator, AAP) within the cluster. + # Example: fulfillment-internal-api-osac.apps.mycluster.example.com + internalHostname: "" + images: # Production: pin to a specific SHA tag. # Development: use "latest". diff --git a/charts/osac/values.schema.json b/charts/osac/values.schema.json index 4d21be0e..c931ca16 100644 --- a/charts/osac/values.schema.json +++ b/charts/osac/values.schema.json @@ -94,8 +94,18 @@ "service": { "type": "object", "description": "Fulfillment Service configuration", - "required": ["auth", "certs"], + "required": ["externalHostname", "internalHostname", "auth", "certs"], "properties": { + "externalHostname": { + "type": "string", + "minLength": 1, + "description": "Hostname for the external API Route" + }, + "internalHostname": { + "type": "string", + "minLength": 1, + "description": "Hostname for the internal API Route" + }, "variant": { "type": "string", "description": "Deployment variant", diff --git a/charts/osac/values.yaml b/charts/osac/values.yaml index f2b23a3b..92e775f2 100644 --- a/charts/osac/values.yaml +++ b/charts/osac/values.yaml @@ -40,6 +40,10 @@ operator: # --- Fulfillment Service --- service: variant: openshift + # [REQUIRED] Hostname for the external API Route (e.g. fulfillment-api-osac.apps.mycluster.example.com) + externalHostname: "" + # [REQUIRED] Hostname for the internal API Route (e.g. fulfillment-internal-api-osac.apps.mycluster.example.com) + internalHostname: "" images: service: ghcr.io/osac-project/fulfillment-service:latest envoy: ghcr.io/osac-project/envoy:v1.33.0 diff --git a/docs/helm-deployment-guide.md b/docs/helm-deployment-guide.md index 44af73d6..b71bd3bd 100644 --- a/docs/helm-deployment-guide.md +++ b/docs/helm-deployment-guide.md @@ -640,6 +640,8 @@ Key settings to review in your values file: | Setting | Description | Where to Find | |---------|-------------|---------------| +| `service.externalHostname` | **Required.** Hostname for the external API Route | `fulfillment-api-${NAMESPACE}.apps..` | +| `service.internalHostname` | **Required.** Hostname for the internal API Route | `fulfillment-internal-api-${NAMESPACE}.apps..` | | `operator.aap.url` | AAP controller API URL | Set post-install by `prepare-aap.sh` | | `service.auth.issuerUrl` | Keycloak realm URL | `https://keycloak.keycloak.svc.cluster.local/realms/osac` (default works) | | `service.idp.url` | Keycloak base URL | `https://keycloak.keycloak.svc.cluster.local` (default works) | @@ -649,6 +651,20 @@ Key settings to review in your values file: | `hubAccess.enabled` | Create hub-access SA and RBAC | `true` (required for hub registration) | | `publishTemplates.enabled` | Create publish-templates-ig ConfigMap | `true` (template publishing config) | +#### Determine API Hostnames + +The fulfillment service requires explicit hostnames for the external and internal API +Routes. These are used in TLS certificate generation and cannot be auto-detected. On +OpenShift, determine your cluster's ingress domain and set the hostnames accordingly: + +```bash +DOMAIN=$(oc get ingresses.config/cluster -o jsonpath='{.spec.domain}') +export EXTERNAL_HOSTNAME="fulfillment-api-${NAMESPACE}.${DOMAIN}" +export INTERNAL_HOSTNAME="fulfillment-internal-api-${NAMESPACE}.${DOMAIN}" +``` + +Set these in your values file or pass them via `--set` at install time. + ### 3.3 Validate ```bash @@ -661,7 +677,10 @@ helm lint charts/osac/ # Dry-run render helm template osac charts/osac/ \ --namespace ${NAMESPACE} \ - --values values/development.yaml > /dev/null + --values values/development.yaml \ + --set service.externalHostname=${EXTERNAL_HOSTNAME} \ + --set service.internalHostname=${INTERNAL_HOSTNAME} \ + > /dev/null ``` ### 3.4 Deploy @@ -671,6 +690,8 @@ helm upgrade --install osac charts/osac/ \ --namespace ${NAMESPACE} \ --create-namespace \ --values values/development.yaml \ + --set service.externalHostname=${EXTERNAL_HOSTNAME} \ + --set service.internalHostname=${INTERNAL_HOSTNAME} \ --timeout 40m \ --wait ``` @@ -807,6 +828,7 @@ Keycloak, AAP. ```bash export NAMESPACE=osac +DOMAIN=$(oc get ingresses.config/cluster -o jsonpath='{.spec.domain}') # Phase 1: Install LVMS (if needed), CNV, cert-manager, trust-manager, # CA issuer, Authorino, Keycloak, AAP operator # Phase 2: Create secrets (license, config-as-code, credentials) @@ -814,6 +836,8 @@ export NAMESPACE=osac helm upgrade --install osac charts/osac/ \ --namespace ${NAMESPACE} --create-namespace \ --values values/vmaas-ci.yaml \ + --set service.externalHostname=fulfillment-api-${NAMESPACE}.${DOMAIN} \ + --set service.internalHostname=fulfillment-internal-api-${NAMESPACE}.${DOMAIN} \ --timeout 40m --wait # Phase 4: Post-install scripts ``` @@ -825,6 +849,7 @@ Keycloak, AAP. ```bash export NAMESPACE=osac +DOMAIN=$(oc get ingresses.config/cluster -o jsonpath='{.spec.domain}') # Phase 1: Install LVMS (if needed), MCE, cert-manager, trust-manager, # CA issuer, Authorino, Keycloak, AAP operator # Phase 2: Create secrets (license, config-as-code, credentials) @@ -832,6 +857,8 @@ export NAMESPACE=osac helm upgrade --install osac charts/osac/ \ --namespace ${NAMESPACE} --create-namespace \ --values values/caas-ci.yaml \ + --set service.externalHostname=fulfillment-api-${NAMESPACE}.${DOMAIN} \ + --set service.internalHostname=fulfillment-internal-api-${NAMESPACE}.${DOMAIN} \ --timeout 40m --wait # Phase 4: Post-install scripts ``` @@ -843,12 +870,15 @@ Authorino, Keycloak, AAP). ```bash export NAMESPACE=osac +DOMAIN=$(oc get ingresses.config/cluster -o jsonpath='{.spec.domain}') # Phase 1: Install all prerequisites # Phase 2: Create secrets # Phase 3: Deploy helm upgrade --install osac charts/osac/ \ --namespace ${NAMESPACE} --create-namespace \ --values values/development.yaml \ + --set service.externalHostname=fulfillment-api-${NAMESPACE}.${DOMAIN} \ + --set service.internalHostname=fulfillment-internal-api-${NAMESPACE}.${DOMAIN} \ --timeout 40m --wait # Phase 4: Post-install scripts ``` diff --git a/values/caas-ci.yaml b/values/caas-ci.yaml index f852f765..3cd78316 100644 --- a/values/caas-ci.yaml +++ b/values/caas-ci.yaml @@ -22,6 +22,8 @@ operator: # --- Fulfillment Service --- service: variant: openshift + externalHostname: "" # Set to fulfillment-api-.apps.. + internalHostname: "" # Set to fulfillment-internal-api-.apps.. images: service: ghcr.io/osac-project/fulfillment-service:sha-ffdfd9f envoy: ghcr.io/osac-project/envoy:v1.33.0 diff --git a/values/development.yaml b/values/development.yaml index 24b58299..9810d464 100644 --- a/values/development.yaml +++ b/values/development.yaml @@ -26,6 +26,8 @@ operator: # --- Fulfillment Service --- service: variant: openshift + externalHostname: "" # Set to fulfillment-api-.apps.. + internalHostname: "" # Set to fulfillment-internal-api-.apps.. images: service: ghcr.io/osac-project/fulfillment-service:latest envoy: ghcr.io/osac-project/envoy:v1.33.0 diff --git a/values/vmaas-ci.yaml b/values/vmaas-ci.yaml index 3c7af721..0c83dd54 100644 --- a/values/vmaas-ci.yaml +++ b/values/vmaas-ci.yaml @@ -22,6 +22,8 @@ operator: # --- Fulfillment Service --- service: variant: openshift + externalHostname: "" # Set to fulfillment-api-.apps.. + internalHostname: "" # Set to fulfillment-internal-api-.apps.. images: service: ghcr.io/osac-project/fulfillment-service:sha-ffdfd9f envoy: ghcr.io/osac-project/envoy:v1.33.0