From: Martin Skorupski Date: Thu, 24 Feb 2022 09:08:42 +0000 (+0000) Subject: Merge "Create a script to generate a Topology" X-Git-Url: https://gerrit.o-ran-sc.org/r/gitweb?a=commitdiff_plain;h=f8d075e545c3539b494b5834ebcade9eedc536d5;hp=65fa7565953545945f3f69c81e0ea2626af7368f;p=oam.git Merge "Create a script to generate a Topology" --- diff --git a/solution/integration/README.md b/solution/integration/README.md index 18085e4..768f5b3 100644 --- a/solution/integration/README.md +++ b/solution/integration/README.md @@ -30,16 +30,18 @@ for developer test or demo purposes ... representing an KeyCloak based identity service for centralized user management. Please note that the implementation does not support IPv6. Therefore, its own network is required called 'DMZ'. + In this configuration the external https port is 8463. * **SDN-R** single node instance ... representing the NetConf consumer on the Service Management and Orchestration framework (SMO) for the O1 interface based on ODL-Silicon/ONAP-Istanbul + SDN-R comes with is own web-portal the external port is 8463. * **VES collector** - ... representing the VES (REST) provider at SMO for all kind of events. + ... representing the VES (REST) provider at SMO for all kind of events. In this configuration the external https port is 8443. * **DMaaP** ... representing SMO DMaaP component, includes message-router @@ -51,7 +53,7 @@ for developer test or demo purposes * **Non-RT-RIC** ... representing all the components of Non-RT-RIC, includes Non-RT-RIC Control Panel, Non-RT-RIC (Spring Cloud) Service Gateway, A1 Policy Management Services, - Enrichment Data Coordinator, Non-RT-RIC App Catalogue, "Helloworld" O-RU Fronthaul Recovery use-case, Near-RT RIC A1 Simulator etc. + Enrichment Data Coordinator, Non-RT-RIC App Catalogue, "HelloWorld" O-RU Fronthaul Recovery use-case, Near-RT RIC A1 Simulator etc. ## Prerequisites @@ -60,7 +62,7 @@ $ cat /etc/os-release | grep PRETTY_NAME PRETTY_NAME="Ubuntu 20.04.2 LTS" $ docker --version -Docker version 20.10.2, build 20.10.2-0ubuntu1~20.04.2 +Docker version 20.10.7, build 20.10.7-0ubuntu1~20.04.2 $ docker-compose version docker-compose version 1.29.1, build c34c88b2 @@ -68,6 +70,7 @@ docker-py version: 5.0.0 CPython version: 3.7.10 OpenSSL version: OpenSSL 1.1.0l 10 Sep 2019 + $ git --version git version 2.25.1 @@ -88,6 +91,13 @@ $ cat /etc/hosts identity ``` +It is beneficial (but not mandatory) adding the following line add the +end of your ~/.bashrc file. I will suppress warnings when python script +do not verify self signed certificates for HTTPS communication. +``` +export PYTHONWARNINGS="ignore:Unverified HTTPS request" +``` + ## Expected Folder Structure ``` @@ -140,6 +150,12 @@ nano smo/oam/.env nano network/.env ``` +The tested configuration uses the following external https ports: + + * 8443 for the ves-collector + * 8453 for web access to ODLUX (SDNC_WEB_PORT) + * 8463 for the keyclock web administrator user interface. + #### Startup solution Please note that it is necessary to configure first the identity service, @@ -199,7 +215,7 @@ script `preparePmsData.sh` sends http requests to policy-agent service, and crea bash prepareEcsData.sh ``` -script `prepareEcsData.sh` sends http requests to ecs service, and creates data accordingly. +script `prepareIcsData.sh` sends http requests to ics service, and creates data accordingly. Afterwards, open webpage: diff --git a/solution/integration/network/config.py b/solution/integration/network/config.py index f1fd0f3..30c4a39 100644 --- a/solution/integration/network/config.py +++ b/solution/integration/network/config.py @@ -25,7 +25,7 @@ import subprocess dockerFilter = subprocess.check_output("docker ps --format '{{.Names}}'", shell=True) containers = dockerFilter.splitlines() -mapping = dict({"ntsim-ng-o-ru": "highstreet-O-RU", "ntsim-ng-o-du": "highstreet-O-DU"}) +mapping = dict({"ntsim-ng-o-ru": "O-RU", "ntsim-ng-o-du": "O-DU"}) # base = 'https://sdnc-web:8453' base = 'https://localhost:8453' username = 'admin' diff --git a/solution/integration/network/docker-compose.yml b/solution/integration/network/docker-compose.yml index 8e0921d..711a915 100755 --- a/solution/integration/network/docker-compose.yml +++ b/solution/integration/network/docker-compose.yml @@ -64,7 +64,7 @@ services: <<: *common_nf image: "${NEXUS3_DOCKER_REPO}nts-ng-o-ran-du:${NTS_BUILD_VERSION}" container_name: ntsim-ng-o-du-1122 - hostname: highstreet-O-DU-1122 + hostname: O-DU-1122 volumes: - ./ntsim-ng-o-du/config.json:/opt/dev/ntsim-ng/config/config.json - ./ntsim-ng-o-du/o-ran-sc-du-hello-world-running.xml:/opt/dev/deploy/data/o-ran-sc-du-hello-world-running.xml @@ -77,7 +77,7 @@ services: <<: *common_nf image: "${NEXUS3_DOCKER_REPO}nts-ng-o-ran-ru-fh:${NTS_BUILD_VERSION}" container_name: ntsim-ng-o-ru-fh-11221 - hostname: highstreet-O-RU-11221 + hostname: O-RU-11221 volumes: - ./ntsim-ng-o-ru/ntsim-ng-o-ru-fh-1/config.json:/opt/dev/ntsim-ng/config/config.json - ./ntsim-ng-o-ru/ntsim-ng-o-ru-fh-1/ietf-hardware-operational.json:/opt/dev/deploy/data/ietf-hardware-operational.json @@ -92,7 +92,7 @@ services: <<: *common_nf image: "${NEXUS3_DOCKER_REPO}nts-ng-o-ran-ru-fh:${NTS_BUILD_VERSION}" container_name: ntsim-ng-o-ru-fh-11222 - hostname: highstreet-O-RU-11222 + hostname: O-RU-11222 volumes: - ./ntsim-ng-o-ru/ntsim-ng-o-ru-fh-2/config.json:/opt/dev/ntsim-ng/config/config.json - ./ntsim-ng-o-ru/ntsim-ng-o-ru-fh-2/ietf-hardware-operational.json:/opt/dev/deploy/data/ietf-hardware-operational.json @@ -107,7 +107,7 @@ services: <<: *common_nf image: "${NEXUS3_DOCKER_REPO}nts-ng-o-ran-ru-fh:${NTS_BUILD_VERSION}" container_name: ntsim-ng-o-ru-fh-11223 - hostname: highstreet-O-RU-11223 + hostname: O-RU-11223 volumes: - ./ntsim-ng-o-ru/ntsim-ng-o-ru-fh-3/config.json:/opt/dev/ntsim-ng/config/config.json - ./ntsim-ng-o-ru/ntsim-ng-o-ru-fh-3/ietf-hardware-operational.json:/opt/dev/deploy/data/ietf-hardware-operational.json @@ -122,7 +122,7 @@ services: <<: *common_nf image: "${NEXUS3_DOCKER_REPO}smo-nts-ng-topology-server:${NTS_BUILD_VERSION}" container_name: ntsim-ng-topology-server - hostname: highstreet-TAPI-topology-server + hostname: TAPI-topology-server volumes: - ./ntsim-ng-topology-server/config.json:/opt/dev/ntsim-ng/config/config.json - ./ntsim-ng-topology-server/tapi-common-operational.xml:/opt/dev/deploy/data/tapi-common-operational.xml @@ -131,7 +131,7 @@ services: <<: *common_env <<: *topo_env SSH_CONNECTIONS: 1 - TLS_CONNECTIONS: 0 + TLS_CONNECTIONS: 0 networks: default: external: diff --git a/solution/integration/network/ntsim-ng-o-du/o-ran-sc-du-hello-world-operational.xml b/solution/integration/network/ntsim-ng-o-du/o-ran-sc-du-hello-world-operational.xml index 0bc12be..503cd79 100644 --- a/solution/integration/network/ntsim-ng-o-du/o-ran-sc-du-hello-world-operational.xml +++ b/solution/integration/network/ntsim-ng-o-du/o-ran-sc-du-hello-world-operational.xml @@ -6,7 +6,7 @@ CN=KarenBerge,CN=admin,DC=corp,DC=Fabrikam,DC=COM address name - O-DU-1211 + O-DU-1122 locked enabled o-du-1 diff --git a/solution/integration/network/ntsim-ng-o-du/o-ran-sc-du-hello-world-running.xml b/solution/integration/network/ntsim-ng-o-du/o-ran-sc-du-hello-world-running.xml index 2d7baf0..a6ca63a 100644 --- a/solution/integration/network/ntsim-ng-o-du/o-ran-sc-du-hello-world-running.xml +++ b/solution/integration/network/ntsim-ng-o-du/o-ran-sc-du-hello-world-running.xml @@ -4,7 +4,7 @@ nf1 CN=KarenBerge,CN=admin,DC=corp,DC=Fabrikam,DC=COM - O-DU-1211 + O-DU-1122 unlocked o-du-1 diff --git a/solution/integration/smo/common/.env b/solution/integration/smo/common/.env index ae91017..f0168b0 100644 --- a/solution/integration/smo/common/.env +++ b/solution/integration/smo/common/.env @@ -29,8 +29,8 @@ NETWORK_GATEWAY_SMO=2001:db8:1:40::1 # Identity server IDENTITY_IMAGE=quay.io/keycloak/keycloak:12.0.4 -IDENTITY_PORT=8081 -IDENTITY_PROVIDER_URL=http://identity:8081 +IDENTITY_PORT=8463 +IDENTITY_PROVIDER_URL=https://identity:8463 # Topology server TOPOLOGY_IMAGE=docker.io/hightec/smo-topology-api-v2:2.0.2-SNAPSHOT-20210315T160448Z diff --git a/solution/integration/smo/common/docker-compose.yml b/solution/integration/smo/common/docker-compose.yml index e3088fd..0e85bf9 100755 --- a/solution/integration/smo/common/docker-compose.yml +++ b/solution/integration/smo/common/docker-compose.yml @@ -19,11 +19,12 @@ services: image: ${IDENTITY_IMAGE} container_name: identity ports: - - ${IDENTITY_PORT}:${IDENTITY_PORT} + - ${IDENTITY_PORT}:8443 environment: - KEYCLOAK_USER=${ADMIN_USERNAME} - KEYCLOAK_PASSWORD=${ADMIN_PASSWORD} - - JAVA_OPTS=-Djboss.http.port=${IDENTITY_PORT} + - JAVA_OPTS=-Djboss.bind.address.private=[::1] -Djboss.bind.address=[::1] -Djava.net.preferIPv6Addresses=true -Djava.net.preferIPv4Stack=false + - DB_VENDOR=h2 networks: dmz: diff --git a/solution/integration/smo/common/identity/config.py b/solution/integration/smo/common/identity/config.py index 649026c..9c1ec28 100644 --- a/solution/integration/smo/common/identity/config.py +++ b/solution/integration/smo/common/identity/config.py @@ -24,7 +24,7 @@ import getpass # global configurations # TODO: read from ../.env -base = 'http://localhost:8081' +base = 'https://identity:8463' username = 'admin' password = 'Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U' realmFile = os.path.dirname(os.path.abspath(__file__)) + '/o-ran-sc-realm.json' @@ -54,7 +54,7 @@ def getToken(): raise SystemExit(e) if response.status_code >= 200 and response.status_code < 300: - print('Got tocken!') + print('Got token!') return response.json()['access_token'] else: sys.exit('Getting token failed.') diff --git a/solution/integration/smo/common/identity/o-ran-sc-realm.json b/solution/integration/smo/common/identity/o-ran-sc-realm.json index c7621d7..97d7b30 100644 --- a/solution/integration/smo/common/identity/o-ran-sc-realm.json +++ b/solution/integration/smo/common/identity/o-ran-sc-realm.json @@ -698,7 +698,6 @@ "clientAuthenticatorType": "client-secret", "secret": "2a64fdca-c205-4b52-9f58-195ccc142ddb", "redirectUris": [ - "http://localhost:8081/*", "https://sdnc-web:8453/*" ], "webOrigins": [], @@ -2151,4 +2150,4 @@ }, "keycloakVersion": "12.0.4", "userManagedAccessAllowed": false -} +} \ No newline at end of file diff --git a/solution/integration/smo/non-rt-ric/.env b/solution/integration/smo/non-rt-ric/.env index ee2b2f8..f9e6b2d 100644 --- a/solution/integration/smo/non-rt-ric/.env +++ b/solution/integration/smo/non-rt-ric/.env @@ -16,20 +16,20 @@ # #PMS -PMS_IMAGE_BASE="nexus3.o-ran-sc.org:10002/o-ran-sc/nonrtric-policy-agent" -PMS_IMAGE_TAG="2.2.0" +PMS_IMAGE_BASE="nexus3.o-ran-sc.org:10002/o-ran-sc/nonrtric-a1-policy-management-service" +PMS_IMAGE_TAG="2.3.1" #A1_SIM A1_SIM_IMAGE_BASE="nexus3.o-ran-sc.org:10002/o-ran-sc/a1-simulator" -A1_SIM_IMAGE_TAG="2.1.0" +A1_SIM_IMAGE_TAG="2.2.0" #RAPP RAPP_IMAGE_BASE="nexus3.o-ran-sc.org:10002/o-ran-sc/nonrtric-r-app-catalogue" -RAPP_IMAGE_TAG="1.0.0" +RAPP_IMAGE_TAG="1.0.2" #CONTROL_PANEL CONTROL_PANEL_IMAGE_BASE="nexus3.o-ran-sc.org:10002/o-ran-sc/nonrtric-controlpanel" -CONTROL_PANEL_IMAGE_TAG="2.2.0" +CONTROL_PANEL_IMAGE_TAG="2.3.0" #GATEWAY NONRTRIC_GATEWAY_IMAGE_BASE="nexus3.o-ran-sc.org:10002/o-ran-sc/nonrtric-gateway" @@ -37,7 +37,7 @@ NONRTRIC_GATEWAY_IMAGE_TAG="1.0.0" #ICS ICS_IMAGE_BASE="nexus3.o-ran-sc.org:10002/o-ran-sc/nonrtric-information-coordinator-service" -ICS_IMAGE_TAG="1.2.0" +ICS_IMAGE_TAG="1.2.1" #PRODUCER PRODUCER_IMAGE_BASE="eexit/mirror-http-server" @@ -45,11 +45,11 @@ PRODUCER_IMAGE_TAG="latest" #ORU ORU_APP_IMAGE_BASE="nexus3.o-ran-sc.org:10002/o-ran-sc/nonrtric-o-ru-closed-loop-recovery" -ORU_APP_IMAGE_TAG="1.0.0" +ORU_APP_IMAGE_TAG="1.0.1" #ODU ODU_APP_IMAGE_BASE="nexus3.o-ran-sc.org:10002/o-ran-sc/nonrtric-o-du-slice-assurance" -ODU_APP_IMAGE_TAG="1.0.0" +ODU_APP_IMAGE_TAG="1.0.1" #DB DB_IMAGE_BASE="mariadb" @@ -57,4 +57,4 @@ DB_IMAGE_TAG="10.5" #A1CONTROLLER A1CONTROLLER_IMAGE_BASE="nexus3.onap.org:10002/onap/sdnc-image" -A1CONTROLLER_IMAGE_TAG="2.1.2" \ No newline at end of file +A1CONTROLLER_IMAGE_TAG="2.1.6" \ No newline at end of file diff --git a/solution/integration/smo/oam/.env b/solution/integration/smo/oam/.env index c21df2b..d049b01 100644 --- a/solution/integration/smo/oam/.env +++ b/solution/integration/smo/oam/.env @@ -28,7 +28,7 @@ NETWORK_SUBNET_OAM_IPv6=2001:db8:1:50::/96 NETWORK_GATEWAY_OAM_IPv6=2001:db8:1:50::1 # Identity server -IDENTITY_PROVIDER_URL=http://identity:8081 +IDENTITY_PROVIDER_URL=https://identity:8463 # SDN Controller SDNC_IMAGE=nexus3.onap.org:10001/onap/sdnc-image:2.2.3 diff --git a/solution/integration/smo/oam/docker-compose.yml b/solution/integration/smo/oam/docker-compose.yml index c73471a..2929fd3 100755 --- a/solution/integration/smo/oam/docker-compose.yml +++ b/solution/integration/smo/oam/docker-compose.yml @@ -66,6 +66,7 @@ services: - IDENTITY_PROVIDER_URL=${IDENTITY_PROVIDER_URL} - SDNC_WEB_URL=https://sdnc-web:${SDNC_WEB_PORT} volumes: + - ./sdnr/oauth-aaa-app-config.xml:/opt/opendaylight/current/system/org/opendaylight/aaa/aaa-shiro/0.13.3/aaa-shiro-0.13.3-aaa-app-config.xml - ./sdnr/oauth-provider.config.json:/opt/opendaylight/etc/oauth-provider.config.json - ./sdnr/devicemanager.properties:/opt/opendaylight/etc/devicemanager.properties - ./sdnr/mountpoint-registrar.properties:/opt/opendaylight/etc/mountpoint-registrar.properties diff --git a/solution/integration/smo/oam/sdnr/oauth-aaa-app-config.xml b/solution/integration/smo/oam/sdnr/oauth-aaa-app-config.xml new file mode 100644 index 0000000..28a79f6 --- /dev/null +++ b/solution/integration/smo/oam/sdnr/oauth-aaa-app-config.xml @@ -0,0 +1,99 @@ + + + + + + +
+ tokenAuthRealm + org.onap.ccsdk.features.sdnr.wt.oauthprovider.OAuth2Realm +
+ +
+ securityManager.realms + $tokenAuthRealm +
+ +
+ authcBasic + org.opendaylight.aaa.shiro.filters.ODLHttpAuthenticationFilter +
+
+ anyroles + org.opendaylight.aaa.shiro.filters.AnyRoleHttpAuthenticationFilter +
+
+ authcBearer + org.opendaylight.aaa.shiro.filters.ODLHttpAuthenticationFilter2 +
+ + +
+ accountingListener + org.opendaylight.aaa.shiro.filters.AuthenticationListener +
+
+ securityManager.authenticator.authenticationListeners + $accountingListener +
+ + +
+ dynamicAuthorization + org.opendaylight.aaa.shiro.realm.MDSALDynamicAuthorizationFilter +
+ + + + /**/operations/cluster-admin** + authcBearer, roles[admin] + + + /**/v1/** + authcBearer, roles[admin] + + + /**/config/aaa*/** + authcBearer, roles[admin] + + + /oauth/** + anon + + + /odlux/** + anon + + + /apidoc/** + authcBasic + + + /rests/** + authcBearer, anyroles["admin,provision"] + + + /** + authcBearer, anyroles["admin,provision"] + + diff --git a/solution/integration/smo/oam/sdnr/oauth-provider.config.json b/solution/integration/smo/oam/sdnr/oauth-provider.config.json index 9f608f5..7f17f68 100644 --- a/solution/integration/smo/oam/sdnr/oauth-provider.config.json +++ b/solution/integration/smo/oam/sdnr/oauth-provider.config.json @@ -1,23 +1,24 @@ { - "tokenSecret": "my-secret", - "tokenIssuer": "ONAP-SDNC", - "publicUrl": "${SDNC_WEB_URL}", - "redirectUri": "/odlux/index.html#/oauth?token=", - "supportOdlUsers": "true", - "providers": [ - { - "id": "identity", - "type": "KEYCLOAK", - "url": "http://identity:8081", - "clientId": "odlux.app", - "secret": "2a64fdca-c205-4b52-9f58-195ccc142ddb", - "scope": "openid", - "title": "ONAP-IDENTITY", - "roleMapping": { - "administration": "admin" - }, - "realmName": "onap", - "trustAll": "true" + "tokenSecret": "my-secret", + "tokenIssuer": "ONAP-SDNC", + "publicUrl": "https://sdnc-web:8453", + "redirectUri": "/odlux/index.html#/oauth?token=", + "supportOdlUsers": "true", + "providers": [ + { + "id": "identity", + "type": "KEYCLOAK", + "url": "https://identity:8463", + "internalUrl": "https://identity:8443", + "clientId": "odlux.app", + "secret": "2a64fdca-c205-4b52-9f58-195ccc142ddb", + "scope": "openid", + "title": "ONAP-IDENTITY", + "roleMapping": { + "administration": "admin" + }, + "realmName": "onap", + "trustAll": "true" } ] -} +} \ No newline at end of file