Skip to content
This repository was archived by the owner on Sep 9, 2026. It is now read-only.

OSAC-1628: Add required externalHostname and internalHostname to umbrella chart #295

Merged
openshift-merge-bot merged 1 commit into from
Jun 18, 2026
Merged

OSAC-1628: Add required externalHostname and internalHostname to umbrella chart #295

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion .github/workflows/helm-integration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,11 @@ jobs:
run: helm lint charts/osac/

- name: Template chart (dry-run validation)
run: helm template osac charts/osac/ --values values/development.yaml > /dev/null
run: |
helm template osac charts/osac/ --values values/development.yaml \
--set service.externalHostname=fulfillment-api.osac.svc.cluster.local \
--set service.internalHostname=fulfillment-internal-api.osac.svc.cluster.local \
> /dev/null

- name: Deploy umbrella chart
continue-on-error: true
Expand All @@ -53,6 +57,8 @@ jobs:
--namespace osac \
--create-namespace \
--values values/development.yaml \
--set service.externalHostname=fulfillment-api.osac.svc.cluster.local \
--set service.internalHostname=fulfillment-internal-api.osac.svc.cluster.local \
--set validation.enabled=false \
--set aap.bootstrap.enabled=false \
--set aap.aap.instance.enabled=false \
Expand All @@ -78,6 +84,8 @@ jobs:
helm upgrade osac charts/osac/ \
--namespace osac \
--values values/development.yaml \
--set service.externalHostname=fulfillment-api.osac.svc.cluster.local \
--set service.internalHostname=fulfillment-internal-api.osac.svc.cluster.local \
--set validation.enabled=false \
--set aap.bootstrap.enabled=false \
--set aap.aap.instance.enabled=false \
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/helm-lint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,10 @@ jobs:
set -euo pipefail
for f in values/*.yaml; do
echo "--- helm template with $(basename "$f") ---"
helm template osac charts/osac/ --values "$f" > /dev/null
helm template osac charts/osac/ --values "$f" \
--set service.externalHostname=fulfillment-api.example.com \
--set service.internalHostname=fulfillment-internal-api.example.com \
> /dev/null
done

- name: Validate values schema
Expand Down
2 changes: 2 additions & 0 deletions charts/osac/ci/bundled-postgres-values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ bundledPostgres:
user: service

service:
externalHostname: fulfillment-api.example.com
internalHostname: fulfillment-internal-api.example.com
auth:
issuerUrl: https://keycloak.example.com/realms/osac
controllerCredentials:
Expand Down
2 changes: 2 additions & 0 deletions charts/osac/ci/default-values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@
# Only sets values that subcharts mark as required.

service:
externalHostname: fulfillment-api.example.com
internalHostname: fulfillment-internal-api.example.com
auth:
issuerUrl: https://keycloak.example.com/realms/osac
controllerCredentials:
Expand Down
2 changes: 2 additions & 0 deletions charts/osac/ci/full-values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ operator:

service:
variant: openshift
externalHostname: fulfillment-api.example.com
internalHostname: fulfillment-internal-api.example.com
auth:
issuerUrl: https://keycloak.keycloak.svc.cluster.local/realms/osac
controllerCredentials:
Expand Down
2 changes: 2 additions & 0 deletions charts/osac/ci/no-aap-values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@
# Exercises the disabled-AAP template branches.

service:
externalHostname: fulfillment-api.example.com
internalHostname: fulfillment-internal-api.example.com
auth:
issuerUrl: https://keycloak.example.com/realms/osac
controllerCredentials:
Expand Down
12 changes: 12 additions & 0 deletions charts/osac/values-example.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,18 @@ service:
# Deployment variant: "openshift" for OCP clusters, "kind" for local dev.
variant: openshift

# [REQUIRED] Hostname used to access the public API from outside the cluster.
# This is the hostname for the OpenShift Route or Ingress that exposes the
# fulfillment API externally.
# Example: fulfillment-api-osac.apps.mycluster.example.com
externalHostname: ""

# [REQUIRED] Hostname used to access both the public and private APIs
# internally. This Route/Ingress is typically not exposed to the internet
# and is used by other OSAC components (operator, AAP) within the cluster.
# Example: fulfillment-internal-api-osac.apps.mycluster.example.com
internalHostname: ""

images:
# Production: pin to a specific SHA tag.
# Development: use "latest".
Expand Down
12 changes: 11 additions & 1 deletion charts/osac/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,8 +94,18 @@
"service": {
"type": "object",
"description": "Fulfillment Service configuration",
"required": ["auth", "certs"],
"required": ["externalHostname", "internalHostname", "auth", "certs"],
"properties": {
"externalHostname": {
"type": "string",
"minLength": 1,
"description": "Hostname for the external API Route"
},
"internalHostname": {
"type": "string",
"minLength": 1,
"description": "Hostname for the internal API Route"
},
Comment on lines +97 to +108

@coderabbitai coderabbitai Bot Jun 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Strengthen hostname validation in schema.

minLength: 1 only checks non-empty values, so syntactically invalid hostnames can pass validation and then fail later at Route/certificate creation. Add a hostname pattern (and preferably max length) for both fields.

Proposed fix 
         "externalHostname": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 253,
+          "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?)(\\.([a-z0-9]([-a-z0-9]*[a-z0-9])?))*$",
           "description": "Hostname for the external API Route"
         },
         "internalHostname": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 253,
+          "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?)(\\.([a-z0-9]([-a-z0-9]*[a-z0-9])?))*$",
           "description": "Hostname for the internal API Route"
         },
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"required": ["externalHostname", "internalHostname", "auth", "certs"],
"properties": {
"externalHostname": {
"type": "string",
"minLength": 1,
"description": "Hostname for the external API Route"
},
"internalHostname": {
"type": "string",
"minLength": 1,
"description": "Hostname for the internal API Route"
},
"required": ["externalHostname", "internalHostname", "auth", "certs"],
"properties": {
"externalHostname": {
"type": "string",
"minLength": 1,
"maxLength": 253,
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?)(\\.([a-z0-9]([-a-z0-9]*[a-z0-9])?))*$",
"description": "Hostname for the external API Route"
},
"internalHostname": {
"type": "string",
"minLength": 1,
"maxLength": 253,
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?)(\\.([a-z0-9]([-a-z0-9]*[a-z0-9])?))*$",
"description": "Hostname for the internal API Route"
},
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/osac/values.schema.json` around lines 97 - 108, The externalHostname
and internalHostname fields in the schema only validate minLength: 1, which
allows syntactically invalid hostnames to pass validation and fail later during
Route or certificate creation. Add a pattern property to both externalHostname
and internalHostname fields with a valid hostname regex pattern (RFC-compliant
FQDN pattern), and also add a maxLength property to enforce reasonable hostname
length limits. This will catch invalid hostnames early at schema validation time
rather than at deployment time.

"variant": {
"type": "string",
"description": "Deployment variant",
Expand Down
4 changes: 4 additions & 0 deletions charts/osac/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,10 @@ operator:
# --- Fulfillment Service ---
service:
variant: openshift
# [REQUIRED] Hostname for the external API Route (e.g. fulfillment-api-osac.apps.mycluster.example.com)
externalHostname: ""
# [REQUIRED] Hostname for the internal API Route (e.g. fulfillment-internal-api-osac.apps.mycluster.example.com)
internalHostname: ""
images:
service: ghcr.io/osac-project/fulfillment-service:latest
envoy: ghcr.io/osac-project/envoy:v1.33.0
Expand Down
32 changes: 31 additions & 1 deletion docs/helm-deployment-guide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -640,6 +640,8 @@ Key settings to review in your values file:

| Setting | Description | Where to Find |
|---------|-------------|---------------|
| `service.externalHostname` | **Required.** Hostname for the external API Route | `fulfillment-api-${NAMESPACE}.apps.<cluster>.<domain>` |
| `service.internalHostname` | **Required.** Hostname for the internal API Route | `fulfillment-internal-api-${NAMESPACE}.apps.<cluster>.<domain>` |
| `operator.aap.url` | AAP controller API URL | Set post-install by `prepare-aap.sh` |
| `service.auth.issuerUrl` | Keycloak realm URL | `https://keycloak.keycloak.svc.cluster.local/realms/osac` (default works) |
| `service.idp.url` | Keycloak base URL | `https://keycloak.keycloak.svc.cluster.local` (default works) |
Expand All @@ -649,6 +651,20 @@ Key settings to review in your values file:
| `hubAccess.enabled` | Create hub-access SA and RBAC | `true` (required for hub registration) |
| `publishTemplates.enabled` | Create publish-templates-ig ConfigMap | `true` (template publishing config) |

#### Determine API Hostnames

The fulfillment service requires explicit hostnames for the external and internal API
Routes. These are used in TLS certificate generation and cannot be auto-detected. On
OpenShift, determine your cluster's ingress domain and set the hostnames accordingly:

```bash
DOMAIN=$(oc get ingresses.config/cluster -o jsonpath='{.spec.domain}')
export EXTERNAL_HOSTNAME="fulfillment-api-${NAMESPACE}.${DOMAIN}"
export INTERNAL_HOSTNAME="fulfillment-internal-api-${NAMESPACE}.${DOMAIN}"
```

Set these in your values file or pass them via `--set` at install time.

### 3.3 Validate

```bash
Expand All @@ -661,7 +677,10 @@ helm lint charts/osac/
# Dry-run render
helm template osac charts/osac/ \
--namespace ${NAMESPACE} \
--values values/development.yaml > /dev/null
--values values/development.yaml \
--set service.externalHostname=${EXTERNAL_HOSTNAME} \
--set service.internalHostname=${INTERNAL_HOSTNAME} \
> /dev/null
```

### 3.4 Deploy
Expand All @@ -671,6 +690,8 @@ helm upgrade --install osac charts/osac/ \
--namespace ${NAMESPACE} \
--create-namespace \
--values values/development.yaml \
--set service.externalHostname=${EXTERNAL_HOSTNAME} \
--set service.internalHostname=${INTERNAL_HOSTNAME} \
--timeout 40m \
--wait
```
Expand Down Expand Up @@ -807,13 +828,16 @@ Keycloak, AAP.

```bash
export NAMESPACE=osac
DOMAIN=$(oc get ingresses.config/cluster -o jsonpath='{.spec.domain}')
# Phase 1: Install LVMS (if needed), CNV, cert-manager, trust-manager,
# CA issuer, Authorino, Keycloak, AAP operator
# Phase 2: Create secrets (license, config-as-code, credentials)
# Phase 3: Deploy
helm upgrade --install osac charts/osac/ \
--namespace ${NAMESPACE} --create-namespace \
--values values/vmaas-ci.yaml \
--set service.externalHostname=fulfillment-api-${NAMESPACE}.${DOMAIN} \
--set service.internalHostname=fulfillment-internal-api-${NAMESPACE}.${DOMAIN} \
--timeout 40m --wait
# Phase 4: Post-install scripts
```
Expand All @@ -825,13 +849,16 @@ Keycloak, AAP.

```bash
export NAMESPACE=osac
DOMAIN=$(oc get ingresses.config/cluster -o jsonpath='{.spec.domain}')
# Phase 1: Install LVMS (if needed), MCE, cert-manager, trust-manager,
# CA issuer, Authorino, Keycloak, AAP operator
# Phase 2: Create secrets (license, config-as-code, credentials)
# Phase 3: Deploy
helm upgrade --install osac charts/osac/ \
--namespace ${NAMESPACE} --create-namespace \
--values values/caas-ci.yaml \
--set service.externalHostname=fulfillment-api-${NAMESPACE}.${DOMAIN} \
--set service.internalHostname=fulfillment-internal-api-${NAMESPACE}.${DOMAIN} \
--timeout 40m --wait
# Phase 4: Post-install scripts
```
Expand All @@ -843,12 +870,15 @@ Authorino, Keycloak, AAP).

```bash
export NAMESPACE=osac
DOMAIN=$(oc get ingresses.config/cluster -o jsonpath='{.spec.domain}')
# Phase 1: Install all prerequisites
# Phase 2: Create secrets
# Phase 3: Deploy
helm upgrade --install osac charts/osac/ \
--namespace ${NAMESPACE} --create-namespace \
--values values/development.yaml \
--set service.externalHostname=fulfillment-api-${NAMESPACE}.${DOMAIN} \
--set service.internalHostname=fulfillment-internal-api-${NAMESPACE}.${DOMAIN} \
--timeout 40m --wait
# Phase 4: Post-install scripts
```
Expand Down
2 changes: 2 additions & 0 deletions values/caas-ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@ operator:
# --- Fulfillment Service ---
service:
variant: openshift
externalHostname: "" # Set to fulfillment-api-<namespace>.apps.<cluster>.<domain>
internalHostname: "" # Set to fulfillment-internal-api-<namespace>.apps.<cluster>.<domain>
images:
service: ghcr.io/osac-project/fulfillment-service:sha-ffdfd9f
envoy: ghcr.io/osac-project/envoy:v1.33.0
Expand Down
2 changes: 2 additions & 0 deletions values/development.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ operator:
# --- Fulfillment Service ---
service:
variant: openshift
externalHostname: "" # Set to fulfillment-api-<namespace>.apps.<cluster>.<domain>
internalHostname: "" # Set to fulfillment-internal-api-<namespace>.apps.<cluster>.<domain>
images:
service: ghcr.io/osac-project/fulfillment-service:latest
envoy: ghcr.io/osac-project/envoy:v1.33.0
Expand Down
2 changes: 2 additions & 0 deletions values/vmaas-ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@ operator:
# --- Fulfillment Service ---
service:
variant: openshift
externalHostname: "" # Set to fulfillment-api-<namespace>.apps.<cluster>.<domain>
internalHostname: "" # Set to fulfillment-internal-api-<namespace>.apps.<cluster>.<domain>
images:
service: ghcr.io/osac-project/fulfillment-service:sha-ffdfd9f
envoy: ghcr.io/osac-project/envoy:v1.33.0
Expand Down
Loading