Skip to content

README.md

Latest commit

 

History

History
142 lines (131 loc) · 9.08 KB

README.md

File metadata and controls

142 lines (131 loc) · 9.08 KB
Raw

Esignet Deployment in Kubernetes Environment

Overview

  • This guide will walk you through the deployment process of the Esignet application.
  • The setup involves creating
    • Kubernetes cluster
    • Setting up Nginx
    • Installing Istio
    • Configuring storage class
    • Configuring the necessary dependent services
    • Deploying Esignet services

Deployment

K8 cluster

  • Kubernetes cluster should be ready with storage class and ingress configured properly.
  • Below is the document containing steps to create and configure K8 cluster.
    • Onprem RKE CLuster : Create RKE K8 cluster using mentioned steps.
      • Persistence : Setup storage class as per steps.
      • Istio service mesh : Setup Istio service mesh using steps.
      • Nginx : Setup and configure nginx as per steps.
      • Logging : Setup logging as per steps.
      • Monitoring : Setup monitoring consisting elasticsearch, kibana, grafana using steps.
    • AWS EKS cluster : Create AWS EKS cluster using mentioned steps.
      • Persistence : Setup storage class as per steps.
      • Ingress and Loadbalancer : Setup nginx and configure NLB for exposing services outside using steps.
      • Logging : Setup logging as per steps.
      • Monitoring : Setup monitoring consisting elasticsearch, kibana, grafana using steps.

Install Pre-requisites

  • esignet-global configmap: For eSignet K8's env, esignet-global configmap in esignet namespace contains Domain related information. Follow below steps to add domain details for esignet-global configmap.
    • Copy esignet-global-cm.yaml.sample to esignet-global-cm.yaml. 
       cp esignet-global-cm.yaml.sample esignet-global-cm.yaml
    • Update the domain names in esignet-global-cm.yaml correctly for your environment.
    • Create a google recaptcha v2 ("I am not a Robot") from Google with required domain name ex:[sandbox.mosip.net] Recaptcha Admin and set esignet captcha.
    • External IAM scope:
      • If using an external IAM, copy the secrets from the external IAM and create a secret named keycloak-client-secrets in the esignet namespace.

Install pre-requisites

./install-prereq.sh

Initialise pre-requisites

  • Update values file for postgres init here.

    • If you are creating a new database, you can choose the database name, user, and connection details as per your requirement in init_values.yaml: 
      dbName: mosip_esignet        # customize e.g. mosip_esignet02
dbUser: esignetuser          # customize e.g. esignetuser02
host: "postgres-postgresql.postgres"
port: 5432
    • If you are fine with the default database name, you don't need to edit anything - simply proceed to execute the script as-is.
    • Important: If you edit init_values.yaml in the postgres directory (e.g. changing dbName or dbUser), you must also update the corresponding values in postgres-config.yaml in the same postgres directory to keep them in sync - otherwise the esignet service will fail to connect to the correct database/user.

  • Execute initialise-prereq.sh script to initialise postgres and keycloak.

    ./initialise-prereq.sh

Install eSignet and the OIDC UI

./install-esignet.sh

You'll be asked which plugin to use:

  1. mock — no external identity system needed, good for local/dev.
  2. mosip — connects to a MOSIP IDA instance. Onboarding runs automatically afterwards.
  3. sunbird — connects to a Sunbird registry.

Plugins 2 and 3 also ask which HSM to use — pick SoftHSM unless you have real hardware HSM set up (that path isn't supported by this script yet). Then you'll set a theme, language, and display name for the OIDC UI.

Note: When deploying multiple plugins in the same cluster, a few manual changes are required in the deployment scripts:

If you are deploying a single plugin in a cluster, these changes are not required.
  • Create a new database for the plugin from the db_scripts directory:
    • Update dbName, dbUser, host, and port in init_values.yaml according to the plugin being deployed.
    • Run the init_db.sh script from the db_scripts directory to create the database. 
      ./init_db.sh
  • Update the namespace and mosip-esignet-host domain in the esignet-global.yaml scripts according to the plugin being deployed.
  • Update the namespace, esignet service name, and SoftHSM name in the esignet directory's install.sh script according to the plugin being deployed.
  • Update the namespace and service name in the oidc-ui directory's install.sh script according to the plugin being deployed.
  • Update the namespace and esignet service name in the partner-onboarder install script if these values are changed for the mosip identity plugin.
    • Example: Sunbird Plugin Deployment
      • namespace: esignet-sunbird
      • mosip-esignet-host: esignet-sunbird.sandbox.mosip.net
      • esignet service name: esignet-sunbird
      • oidc service name: oidc-ui-sunbird

Note:

  • Before proceeding with the Onboarding steps, please ensure that the Mock Relying Party services are deployed and running.
  • Deployment of the mock Relying Party portal is optional if you already have your own Relying Party portal.
  • You can refer to the default mock relying party implementation here:
  • Once the Relying Party is deployed, proceed with the onboarding.

Onboarder

  • There are two ways to proceed, either with mosip identity plugin or with mock plugin.

MOSIP Identity Plugin

  • If Esignet is getting deployed with MOSIP then we need to execute the onboarder for MISP partner and mock-rp oidc clientId.
  • Onboarder scripts.

MOCK Plugin

Download and import eSignet-with-mock.postman_environment.json and eSignet.postman_collection.json postman collection from here)

OIDC Client Management Instructions

  1. Fetch the Authentication Token Navigate to "OIDC Client Mgmt" → "Mock" → "Get Auth Token" to retrieve the authentication token.
  • Update the client_secret (retrieve it from the keycloak-client-secrets).
  • Update the iam_url (Keycloak URL) in the request body.
    • Retrieve the Keycloak URL from the config-map under keycloak-host → keycloak-external-url.
  1. Fetch the CSRF Token
  • Navigate to "OIDC Client Mgmt" → "Mock" → "Get CSRF Token" to obtain the CSRF token.
  • Update the "url" to ge the CSRF Token.
  1. Update the Request Fields for OIDC Client Creation
  • Before executing the "Create OIDC Client" request, update the following fields in the request body:
    • url
    • logo-uri
    • redirect-uri
    • client-name
    • client-id
  1. Update the clientId in Deployment
  • Once the clientId is created and activated, update the clientId in the mock-relying-party-ui deployment.
  1. Update the Client Private Key
  • Retrieve the client-private-key from the eSignet-with-mock Postman environment, as shown in the image below:
    • postman-image.png
    • Encode the retrieved client-private-key using Base64.
    • Update the Base64-encoded client-private-key in the mock-relying-party service secret.

NOTE:

This deployment is limited to mock Below section related to configuring IDA is not tested. Still it can be tried out

CONFIGURE IDA for Esignet :

Onboard eSignet as MISP partner in MOSIP PMS using our onboarder script We should override properties defined here if there is any change in the MOSIP IDA domain names. Update the 'MOSIP_ESIGNET_AUTHENTICATOR_IDA_SECRET_KEY' property with MOSIP IDA keycloak client secret.

ESIGNET-APITESTRIG INSTALLATION

esignet-apitestrig will test the APIs and the end-to-end functional flow of the eSignet modules. esignet-apitestrig

UNINSTALLING ESIGNET

To completely remove eSignet from your Kubernetes environment, run the following commands.

./delete-all.sh