-
Notifications
You must be signed in to change notification settings - Fork 6
Expand file tree
/
Copy pathvalues-dev.yaml
More file actions
144 lines (135 loc) · 5.41 KB
/
Copy pathvalues-dev.yaml
File metadata and controls
144 lines (135 loc) · 5.41 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
# Helm values overlay used ONLY to render local dev config via
# `make render-helm-config` / `scripts/render-helm-config.py`.
#
# This is never applied to a real cluster. It exists so sirosid-dev can feed
# wallet-backend and go-trust (PDP) the exact same config schema Helm renders
# in production (the siros-id-stack chart), instead of a hand-maintained,
# independently-drifting set of env vars.
#
# Fields the renderer post-processes after `helm template` (see
# scripts/render-helm-config.py for the exact rewrites and why):
# - storage.mongodb / mongo: Helm renders x509 mTLS against the MongoDB
# Community Operator. Locally we run a single plain `mongo` container
# (see docker-compose.vc-services.yml), so the renderer swaps the URI
# for a plain one and drops the TLS/cert fields. This is a deliberate,
# documented exception - not something values overrides can express.
# - trust.pdp_url / rp_origins / base_url: k8s Service DNS + https
# hostnames get rewritten to the docker-compose service names and
# http://localhost ports sirosid-dev already uses.
tenant:
# "default" everywhere else in this repo - the Makefile's TENANT_ID, the
# wallet frontend's BASE_PATH=/id/default/, and the tenant
# register-vc-services POSTs to. tenant.id feeds the vc services' public
# URLs now, so it has to agree with them.
id: default
namespace: sirosid-dev
domain:
root: localhost
# Explicit per-service hostnames, replacing the chart's
# <tenant>.<service>.<domain> derivation. These carry a port, because in
# docker-compose one advertised public URL has to work both from the host
# browser and from inside the compose network - which is also why the
# published and container ports have to be equal for apigw and the verifier
# (see docker-compose.vc-services.yml's own comment on that).
#
# The chart hardcodes an https:// scheme in front of each of these;
# render-helm-config.py rewrites it to http:// for exactly this host list, via
# vc_render.COMPOSE_PLAIN_HTTP_HOSTS - keep the two in step.
hostnames:
issuer: "vc-apigw.localhost:9003"
issuerRegistry: "vc-registry.localhost:9004"
verifier: "vc-verifier.localhost:9001"
walletFrontend: "localhost:3000"
walletBackend: "localhost:8080"
issuer:
authProviders:
oidc:
# mini-oidc, reachable under the same name from both the host and the
# compose network (see the Makefile's MINI_OIDC_ISSUER).
issuerUrl: "http://mini-oidc.localhost:9005"
clientId: "apigw-oidc-client"
apigw:
extraConfig:
apigw:
api_server:
addr: ":9003"
# The chart wires cert-manager mTLS between k8s Services; compose has
# no such certs and talks plaintext gRPC over the compose network.
# The cert paths the chart also renders are simply never read when
# tls is false (vc's GRPCClientTLS).
issuer_client:
addr: "vc-issuer:8090"
tls: false
registry_client:
addr: "vc-registry:8090"
tls: false
core:
extraConfig:
issuer:
registry_client:
addr: "vc-registry:8090"
tls: false
registry:
extraConfig:
registry:
api_server:
addr: ":9004"
verifier:
extraConfig:
verifier:
api_server:
addr: ":9001"
# The chart's own default is "" (no longer a non-empty placeholder as of the
# siros-id-stack chart) - required (siros-id-stack's own README: "the chart
# defaults alone are not deployable") for 04-wallet-backend.yaml/
# 04-wallet-frontend.yaml's HTTPRoute parentRefs to render at all; this is
# never applied to a real cluster, so any placeholder value works here.
gateway:
name: gateway
namespace: siros-shared
features:
generateSecrets: false
credentialTypes: {}
pdp:
# The chart's own default_whitelist always whitelists https://<tenant>.issuer.<domain>
# and https://<tenant>.verifier.<domain> - hardcoded https, unreachable locally.
# Since there's no values-level toggle for scheme, we disable it and supply an
# equivalent whitelist directly via extraRegistries, using real sirosid-dev
# compose service URLs (both container-internal and host-mapped forms, matching
# mock-trust-pdp's existing TRUSTED_ISSUERS/TRUSTED_VERIFIERS in docker-compose.test.yml).
default_whitelist: false
externalUrl: "http://go-trust-config:6001"
extraRegistries:
whitelist:
enabled: true
name: "sirosid-dev local whitelist"
description: "docker-compose vc-services URLs (rendered from siros-id-stack schema)"
# Local vc-services are plain http, but the whitelist registry's JWKS
# auto-discovery refuses http by default (pkg/registry/static/whitelist.go:123,
# "testing only" per its own comment) - without this, every whitelisted
# entity fails key discovery and ends up with 0 usable issuers/verifiers.
allow_http: true
lists:
pid-issuers:
- http://vc-issuer:8080
- http://localhost:9000
- http://vc-apigw:8080
- http://localhost:9003
verifiers:
- http://vc-issuer:8080
- http://localhost:9000
- http://vc-apigw:8080
- http://localhost:9003
- http://vc-verifier:8080
- http://localhost:9001
actions:
pid-provider: pid-issuers
credential-issuer: pid-issuers
verifier: verifiers
credential-verifier: verifiers
replicas:
pdp: 1
walletBackend: 1
global:
certManager:
createIssuers: false