From 3b99b069edee349fd47eb543db350c862e680c82 Mon Sep 17 00:00:00 2001 From: praveenkumarsamala Date: Wed, 19 Aug 2026 09:19:19 +0530 Subject: [PATCH 1/8] 5422 changes --- example/Makefile | 17 ++--- example/gateway/portal-gateway.yaml | 8 +- .../g2c-agent/deployment-template.yaml | 4 +- example/portal-integration/portal-values.yaml | 73 ++++--------------- 4 files changed, 29 insertions(+), 73 deletions(-) diff --git a/example/Makefile b/example/Makefile index d7a722f1..aece94ce 100644 --- a/example/Makefile +++ b/example/Makefile @@ -23,7 +23,7 @@ create-collector: rm -rf $(tmp) install: - kubectl apply -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.3.0/bundle.yaml + kubectl apply -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.2.2/bundle.yaml @$(MAKE) --silent t=10 wait kubectl wait --for=condition=ready --timeout=600s pod -l app.kubernetes.io/name=layer7-operator @@ -43,7 +43,7 @@ otk-single: kubectl apply -f ./gateway/otk/otk-single.yaml portal-example: redis - kubectl apply -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.3.0/bundle.yaml -n ${NAMESPACE} + kubectl apply -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.2.2/bundle.yaml -n ${NAMESPACE} @$(MAKE) --silent t=15 wait kubectl -n ${NAMESPACE} wait --for=condition=ready --timeout=600s pod -l app.kubernetes.io/name=layer7-operator kubectl apply -k ./base -n ${NAMESPACE} @@ -62,7 +62,7 @@ portal-example: redis ./portal-integration/create-tenant.sh -d ./portal-integration/enroll-payload.json -n ${NAMESPACE} g2c-agent: -#sed -e 's/ip:.*/ip: "$(shell kubectl get svc ingress-nginx-controller -n ingress-nginx -ojsonpath="{.spec.clusterIP}")"/g' ./portal-integration/g2c-agent/deployment-template.yaml > ./portal-integration/g2c-agent/deployment.yaml + sed -e 's/ip:.*/ip: "$(shell kubectl get svc contour-envoy -n projectcontour -ojsonpath="{.spec.clusterIP}")"/g' ./portal-integration/g2c-agent/deployment-template.yaml > ./portal-integration/g2c-agent/deployment.yaml kubectl apply -k ./portal-integration/g2c-agent echo "deploy g2cagent" @@ -78,7 +78,7 @@ default-redis: kubectl wait --for=condition=ready --timeout=600s pod -l app.kubernetes.io/name=redis grafana-stack: - helm repo add grafana https://grafana.github.io/helm-charts + helm repo add grafana https://grafana-community.github.io/helm-charts helm upgrade --install --values ./otel-lgtm/grafana-stack/loki-overrides.yaml loki grafana/loki -n grafana-loki --create-namespace helm upgrade --install --values ./otel-lgtm/grafana-stack/promtail-overrides.yaml promtail grafana/promtail -n grafana-loki helm upgrade --install --values ./otel-lgtm/grafana-stack/tempo-overrides.yaml tempo grafana/tempo -n grafana-loki @@ -250,7 +250,7 @@ pki-otk-dmz: pki-otk -kubectl create secret tls otk-dmz-mtls-secret \ --cert=/tmp/otk-dmz-mtls.crt --key=/tmp/otk-dmz-mtls.key \ -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - - -kubectl create configmap otk-internal-ca-cert \ + -kubectl create secret generic otk-internal-ca-cert \ --from-file=ca.crt=/tmp/otk-internal-tls.crt \ -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - @@ -258,12 +258,9 @@ pki-otk-internal: pki-otk -kubectl create secret tls otk-internal-secret \ --cert=/tmp/otk-internal-tls.crt --key=/tmp/otk-internal-tls.key \ -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - - -kubectl create configmap otk-dmz-mtls-public-cert \ + -kubectl create secret generic otk-dmz-mtls-public-cert \ --from-file=dmz-gateway.crt=/tmp/otk-dmz-mtls.crt \ -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - - -kubectl create configmap otk-dmz-mtls-ca-cert \ - --from-file=dmz-gateway-mtls-ca.crt=/tmp/otk-dmz-mtls-ca.crt \ - -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - cassandra: helm upgrade --install cassandra -f ./otk/database/cassandra/cassandra-values.yaml oci://registry-1.docker.io/bitnamicharts/cassandra @@ -291,7 +288,7 @@ uninstall: -kubectl delete -f https://github.com/jaegertracing/jaeger-operator/releases/download/v1.65.0/jaeger-operator.yaml -n observability -kubectl delete ns observability -kubectl delete ns monitoring - -kubectl delete -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.3.0/bundle.yaml + -kubectl delete -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.2.2/bundle.yaml -helm uninstall mysql -helm uninstall cassandra -helm uninstall contour -n projectcontour diff --git a/example/gateway/portal-gateway.yaml b/example/gateway/portal-gateway.yaml index 63fec246..71b9086f 100644 --- a/example/gateway/portal-gateway.yaml +++ b/example/gateway/portal-gateway.yaml @@ -3,7 +3,7 @@ kind: Gateway metadata: name: portal-ssg spec: - version: "11.1.2" + version: "11.1.3" license: accept: false secretName: gateway-license @@ -13,7 +13,7 @@ spec: minAvailable: 2 replicas: 1 restartOnConfigChange: true - image: caapim/gateway:11.1.2 + image: caapim/gateway:11.1.3 imagePullPolicy: IfNotPresent updateStrategy: type: rollingUpdate @@ -72,14 +72,14 @@ spec: portalReference: enabled: true portalName: example-k8 - initContainerImage: caapim/portal-bulk-sync:5.3.3 + initContainerImage: caapim/portal-bulk-sync:5.4.2 initContainerImagePullPolicy: Always bootstrap: script: enabled: true initContainers: - name: gateway-init - image: caapim/gateway-init-portal:5.3.3 + image: caapim/gateway-init-portal:5.4.2 imagePullPolicy: Always volumeMounts: - name: config-directory diff --git a/example/portal-integration/g2c-agent/deployment-template.yaml b/example/portal-integration/g2c-agent/deployment-template.yaml index 580e2af7..04113012 100644 --- a/example/portal-integration/g2c-agent/deployment-template.yaml +++ b/example/portal-integration/g2c-agent/deployment-template.yaml @@ -16,14 +16,14 @@ spec: spec: serviceAccountName: portal-g2c-agent hostAliases: - - ip: "10.96.228.133" + - ip: "10.252.128.127" hostnames: - "dev-portal-enroll.brcmlabs.com" - "dev-portal-broker.brcmlabs.com" - "dev-portal-ssg.brcmlabs.com" containers: - name: portal-g2c-agent - image: caapim/portal-g2c-agent:5.3.3 + image: caapim/portal-g2c-agent:5.4.2 imagePullPolicy: Always resources: requests: diff --git a/example/portal-integration/portal-values.yaml b/example/portal-integration/portal-values.yaml index 6f7b2098..fd1d5cac 100644 --- a/example/portal-integration/portal-values.yaml +++ b/example/portal-integration/portal-values.yaml @@ -10,6 +10,8 @@ portal: domain: brcmlabs.com analytics: enabled: false + seaweedFs: + enabled: false internalSSG: secretName: ssg-secret papi: @@ -30,17 +32,17 @@ ingress: - portal image: - dispatcher: dispatcher:5.3.3 - apim: ingress:5.3.3 - enterprise: portal-enterprise:5.3.3 - data: portal-data:5.3.3 - tps: tenant-provisioning-service:5.3.3 - analytics: analytics-server:5.3.3 - authenticator: authenticator:5.3.3 - dbUpgrade: db-upgrade-portal:5.3.3 - rbacUpgrade: db-upgrade-rbac:5.3.3 - upgradeVerify: upgrade-verify:5.3.3 - tlsManager: tls-automator:5.3.3 + dispatcher: dispatcher:5.4.2.2 + apim: ingress:5.4.2.2 + enterprise: portal-enterprise:5.4.2.2 + data: portal-data:5.4.2.2 + tps: tenant-provisioning-service:5.4.2.2 + analytics: analytics-server:5.4.2.2 + authenticator: authenticator:5.4.2.2 + dbUpgrade: db-upgrade-portal:5.4.2.1 + rbacUpgrade: db-upgrade-rbac:5.4.2 + upgradeVerify: upgrade-verify:5.4.2 + tlsManager: tls-automator:5.4.2 rabbitmq: enabled: true @@ -49,7 +51,7 @@ rabbitmq: image: registry: caapim repository: message-broker - tag: "5.3.3" + tag: "5.4.2" pullSecrets: - broadcom-apim pdb: @@ -109,54 +111,11 @@ rabbitmq: mysql: image: - registry: docker.io - repository: bitnamilegacy/mysql - tag: "8.0.36-debian-11-r4" - auth: - username: portal - existingSecret: database-secret + repository: docker.io/mysql + tag: "8.4.4" initdbScripts: elevate-admin.sql: | GRANT ALL PRIVILEGES ON *.* TO 'portal'@'%'; FLUSH PRIVILEGES; - primary: - configuration: |- - [client] - port=3306 - socket=/opt/bitnami/mysql/tmp/mysql.sock - default-character-set=utf8mb4 - plugin_dir=/opt/bitnami/mysql/plugin - [mysqld] - default_authentication_plugin=mysql_native_password - skip-name-resolve - explicit_defaults_for_timestamp - basedir=/opt/bitnami/mysql - plugin_dir=/opt/bitnami/mysql/plugin - port=3306 - socket=/opt/bitnami/mysql/tmp/mysql.sock - datadir=/bitnami/mysql/data - tmpdir=/opt/bitnami/mysql/tmp - collation-server=utf8mb4_0900_ai_ci - character-set-server=utf8mb4 - innodb_log_buffer_size=32M - innodb_log_file_size=80M - max_allowed_packet=8M - group_concat_max_len=512000 - sql_mode = "STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION" - bind-address=0.0.0.0 - pid-file=/opt/bitnami/mysql/tmp/mysqld.pid - log-error=/opt/bitnami/mysql/logs/mysqld.log - [manager] - port=3306 - socket=/opt/bitnami/mysql/tmp/mysql.sock - pid-file=/opt/bitnami/mysql/tmp/mysqld.pid - pdb: - create: false - maxUnavailable: "" - minAvailable: "" - persistence: - annotations: - helm.sh/hook: pre-install - helm.sh/hook-weight: "-10" commonAnnotations: helm.sh/hook: pre-install helm.sh/hook-weight: "-10" From 3fc35ec745ac212e564dd1a680abc287798d8581 Mon Sep 17 00:00:00 2001 From: praveenkumarsamala Date: Thu, 20 Aug 2026 18:41:12 +0530 Subject: [PATCH 2/8] 5422 changes --- example/gateway/portal-gateway.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/example/gateway/portal-gateway.yaml b/example/gateway/portal-gateway.yaml index 71b9086f..a2068200 100644 --- a/example/gateway/portal-gateway.yaml +++ b/example/gateway/portal-gateway.yaml @@ -3,7 +3,7 @@ kind: Gateway metadata: name: portal-ssg spec: - version: "11.1.3" + version: "11.2.0" license: accept: false secretName: gateway-license @@ -13,7 +13,7 @@ spec: minAvailable: 2 replicas: 1 restartOnConfigChange: true - image: caapim/gateway:11.1.3 + image: caapim/gateway:11.2.0 imagePullPolicy: IfNotPresent updateStrategy: type: rollingUpdate From 9e8d6cf5e0537177a201ce321ecfe720ab5335ea Mon Sep 17 00:00:00 2001 From: praveenkumarsamala Date: Thu, 20 Aug 2026 19:21:00 +0530 Subject: [PATCH 3/8] 5422 changes --- example/Makefile | 10 +++++----- .../g2c-agent/deployment-template.yaml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/example/Makefile b/example/Makefile index aece94ce..1c6d6ac3 100644 --- a/example/Makefile +++ b/example/Makefile @@ -23,7 +23,7 @@ create-collector: rm -rf $(tmp) install: - kubectl apply -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.2.2/bundle.yaml + kubectl apply -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.3.0/bundle.yaml @$(MAKE) --silent t=10 wait kubectl wait --for=condition=ready --timeout=600s pod -l app.kubernetes.io/name=layer7-operator @@ -43,7 +43,7 @@ otk-single: kubectl apply -f ./gateway/otk/otk-single.yaml portal-example: redis - kubectl apply -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.2.2/bundle.yaml -n ${NAMESPACE} + kubectl apply -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.3.0/bundle.yaml -n ${NAMESPACE} @$(MAKE) --silent t=15 wait kubectl -n ${NAMESPACE} wait --for=condition=ready --timeout=600s pod -l app.kubernetes.io/name=layer7-operator kubectl apply -k ./base -n ${NAMESPACE} @@ -250,7 +250,7 @@ pki-otk-dmz: pki-otk -kubectl create secret tls otk-dmz-mtls-secret \ --cert=/tmp/otk-dmz-mtls.crt --key=/tmp/otk-dmz-mtls.key \ -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - - -kubectl create secret generic otk-internal-ca-cert \ + -kubectl create configmap otk-internal-ca-cert \ --from-file=ca.crt=/tmp/otk-internal-tls.crt \ -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - @@ -258,7 +258,7 @@ pki-otk-internal: pki-otk -kubectl create secret tls otk-internal-secret \ --cert=/tmp/otk-internal-tls.crt --key=/tmp/otk-internal-tls.key \ -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - - -kubectl create secret generic otk-dmz-mtls-public-cert \ + -kubectl create configmap otk-dmz-mtls-public-cert \ --from-file=dmz-gateway.crt=/tmp/otk-dmz-mtls.crt \ -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - @@ -288,7 +288,7 @@ uninstall: -kubectl delete -f https://github.com/jaegertracing/jaeger-operator/releases/download/v1.65.0/jaeger-operator.yaml -n observability -kubectl delete ns observability -kubectl delete ns monitoring - -kubectl delete -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.2.2/bundle.yaml + -kubectl delete -f https://github.com/CAAPIM/layer7-operator/releases/download/v1.3.0/bundle.yaml -helm uninstall mysql -helm uninstall cassandra -helm uninstall contour -n projectcontour diff --git a/example/portal-integration/g2c-agent/deployment-template.yaml b/example/portal-integration/g2c-agent/deployment-template.yaml index 04113012..90c61b34 100644 --- a/example/portal-integration/g2c-agent/deployment-template.yaml +++ b/example/portal-integration/g2c-agent/deployment-template.yaml @@ -16,7 +16,7 @@ spec: spec: serviceAccountName: portal-g2c-agent hostAliases: - - ip: "10.252.128.127" + - ip: "10.96.228.133" hostnames: - "dev-portal-enroll.brcmlabs.com" - "dev-portal-broker.brcmlabs.com" From c5cc4dd45883966a83b6417fb5d90d46bbe71aad Mon Sep 17 00:00:00 2001 From: praveenkumarsamala Date: Sun, 6 Sep 2026 13:24:58 +0530 Subject: [PATCH 4/8] 5423 changes: update portal version reference to 5.4.2.3 --- example/portal-integration/readme.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/example/portal-integration/readme.md b/example/portal-integration/readme.md index d958a986..a2974cbd 100644 --- a/example/portal-integration/readme.md +++ b/example/portal-integration/readme.md @@ -166,7 +166,7 @@ kubectl get pods ``` ### Deploy the Developer Portal -The Portal deployed is version 5.3.3 which supports layer7-operator gateways enroled with the portal as a proxy. +The Portal deployed is version 5.4.2.3 which supports layer7-operator gateways enroled with the portal as a proxy. The Portal is deployed to the default namespace and uses the following [portal-values.yaml](../portal-integration/portal-values.yaml) You can deploy the portal using the following commands From b3dfd3efcd4e09f3d44542090c2c3f823cf3abb8 Mon Sep 17 00:00:00 2001 From: praveenkumarsamala Date: Sun, 6 Sep 2026 16:59:39 +0530 Subject: [PATCH 5/8] Restore otk-dmz-mtls-ca-cert configmap creation in pki-otk-internal Reverts an unintended removal from an earlier 5422 commit; otk-internal.yaml still references this configmap as an externalCert. --- example/Makefile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/example/Makefile b/example/Makefile index 1c6d6ac3..39701b1f 100644 --- a/example/Makefile +++ b/example/Makefile @@ -261,6 +261,9 @@ pki-otk-internal: pki-otk -kubectl create configmap otk-dmz-mtls-public-cert \ --from-file=dmz-gateway.crt=/tmp/otk-dmz-mtls.crt \ -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - + -kubectl create configmap otk-dmz-mtls-ca-cert \ + --from-file=dmz-gateway-mtls-ca.crt=/tmp/otk-dmz-mtls-ca.crt \ + -n $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - cassandra: helm upgrade --install cassandra -f ./otk/database/cassandra/cassandra-values.yaml oci://registry-1.docker.io/bitnamicharts/cassandra From 5b23b72b035575d1377cd61ef4c812da76aa18ee Mon Sep 17 00:00:00 2001 From: praveenkumarsamala Date: Sun, 6 Sep 2026 17:01:23 +0530 Subject: [PATCH 6/8] Bump all portal component image tags to 5.4.2.3 --- example/portal-integration/portal-values.yaml | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/example/portal-integration/portal-values.yaml b/example/portal-integration/portal-values.yaml index fd1d5cac..0824009e 100644 --- a/example/portal-integration/portal-values.yaml +++ b/example/portal-integration/portal-values.yaml @@ -32,17 +32,17 @@ ingress: - portal image: - dispatcher: dispatcher:5.4.2.2 - apim: ingress:5.4.2.2 - enterprise: portal-enterprise:5.4.2.2 - data: portal-data:5.4.2.2 - tps: tenant-provisioning-service:5.4.2.2 - analytics: analytics-server:5.4.2.2 - authenticator: authenticator:5.4.2.2 - dbUpgrade: db-upgrade-portal:5.4.2.1 - rbacUpgrade: db-upgrade-rbac:5.4.2 - upgradeVerify: upgrade-verify:5.4.2 - tlsManager: tls-automator:5.4.2 + dispatcher: dispatcher:5.4.2.3 + apim: ingress:5.4.2.3 + enterprise: portal-enterprise:5.4.2.3 + data: portal-data:5.4.2.3 + tps: tenant-provisioning-service:5.4.2.3 + analytics: analytics-server:5.4.2.3 + authenticator: authenticator:5.4.2.3 + dbUpgrade: db-upgrade-portal:5.4.2.3 + rbacUpgrade: db-upgrade-rbac:5.4.2.3 + upgradeVerify: upgrade-verify:5.4.2.3 + tlsManager: tls-automator:5.4.2.3 rabbitmq: enabled: true From 19139eb502cfd77588bae644d99270ec757f23fd Mon Sep 17 00:00:00 2001 From: praveenkumarsamala Date: Sun, 6 Sep 2026 18:57:52 +0530 Subject: [PATCH 7/8] reverting mysql changes --- example/portal-integration/portal-values.yaml | 47 ++++++++++++++++++- 1 file changed, 45 insertions(+), 2 deletions(-) diff --git a/example/portal-integration/portal-values.yaml b/example/portal-integration/portal-values.yaml index 0824009e..19e8b1a8 100644 --- a/example/portal-integration/portal-values.yaml +++ b/example/portal-integration/portal-values.yaml @@ -111,11 +111,54 @@ rabbitmq: mysql: image: - repository: docker.io/mysql - tag: "8.4.4" + registry: docker.io + repository: bitnamilegacy/mysql + tag: "8.0.36-debian-11-r4" + auth: + username: portal + existingSecret: database-secret initdbScripts: elevate-admin.sql: | GRANT ALL PRIVILEGES ON *.* TO 'portal'@'%'; FLUSH PRIVILEGES; + primary: + configuration: |- + [client] + port=3306 + socket=/opt/bitnami/mysql/tmp/mysql.sock + default-character-set=utf8mb4 + plugin_dir=/opt/bitnami/mysql/plugin + [mysqld] + default_authentication_plugin=mysql_native_password + skip-name-resolve + explicit_defaults_for_timestamp + basedir=/opt/bitnami/mysql + plugin_dir=/opt/bitnami/mysql/plugin + port=3306 + socket=/opt/bitnami/mysql/tmp/mysql.sock + datadir=/bitnami/mysql/data + tmpdir=/opt/bitnami/mysql/tmp + collation-server=utf8mb4_0900_ai_ci + character-set-server=utf8mb4 + innodb_log_buffer_size=32M + innodb_log_file_size=80M + max_allowed_packet=8M + group_concat_max_len=512000 + sql_mode = "STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION" + bind-address=0.0.0.0 + pid-file=/opt/bitnami/mysql/tmp/mysqld.pid + log-error=/opt/bitnami/mysql/logs/mysqld.log + [manager] + port=3306 + socket=/opt/bitnami/mysql/tmp/mysql.sock + pid-file=/opt/bitnami/mysql/tmp/mysqld.pid + pdb: + create: false + maxUnavailable: "" + minAvailable: "" + persistence: + annotations: + helm.sh/hook: pre-install + helm.sh/hook-weight: "-10" commonAnnotations: helm.sh/hook: pre-install helm.sh/hook-weight: "-10" From 4c3c1f85438a398c0f0cae75e36252cf962a46df Mon Sep 17 00:00:00 2001 From: praveenkumarsamala Date: Tue, 8 Sep 2026 10:14:33 +0530 Subject: [PATCH 8/8] gateway version changes --- example/gateway/portal-gateway.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/example/gateway/portal-gateway.yaml b/example/gateway/portal-gateway.yaml index a2068200..c098d02d 100644 --- a/example/gateway/portal-gateway.yaml +++ b/example/gateway/portal-gateway.yaml @@ -3,7 +3,7 @@ kind: Gateway metadata: name: portal-ssg spec: - version: "11.2.0" + version: "11.2.1" license: accept: false secretName: gateway-license @@ -13,7 +13,7 @@ spec: minAvailable: 2 replicas: 1 restartOnConfigChange: true - image: caapim/gateway:11.2.0 + image: caapim/gateway:11.2.1 imagePullPolicy: IfNotPresent updateStrategy: type: rollingUpdate @@ -79,7 +79,7 @@ spec: enabled: true initContainers: - name: gateway-init - image: caapim/gateway-init-portal:5.4.2 + image: caapim/gateway-init-portal:5.4.2.3 imagePullPolicy: Always volumeMounts: - name: config-directory