diff --git a/CHANGELOG.md b/CHANGELOG.md index 1de1fc596..922e0d90f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] -## [0.5.0-rc1] - 2023-06-21 +## [0.5.0-rc2] - 2023-06-23 + +## [0.5.0-rc2] - 2023-06-23 + +### Changed + +Upgraded to EDC 0.1.2 ## [0.5.0-rc1] - 2023-06-21 @@ -342,7 +348,9 @@ corresponding [documentation](/docs/migration/Version_0.0.x_0.1.x.md). ## [0.0.1] - 2022-05-13 -[Unreleased]: https://github.com/eclipse-tractusx/tractusx-edc/compare/0.5.0-rc1...HEAD +[Unreleased]: https://github.com/eclipse-tractusx/tractusx-edc/compare/0.5.0-rc2...HEAD + +[0.5.0-rc2]: https://github.com/eclipse-tractusx/tractusx-edc/compare/0.5.0-rc1...0.5.0-rc2 [0.5.0-rc1]: https://github.com/eclipse-tractusx/tractusx-edc/compare/0.4.1...0.5.0-rc1 diff --git a/charts/tractusx-connector-azure-vault/Chart.yaml b/charts/tractusx-connector-azure-vault/Chart.yaml index 78c8f0823..5b78ab40d 100644 --- a/charts/tractusx-connector-azure-vault/Chart.yaml +++ b/charts/tractusx-connector-azure-vault/Chart.yaml @@ -40,12 +40,12 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.5.0-rc1 +version: 0.5.0-rc2 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "0.5.0-rc1" +appVersion: "0.5.0-rc2" home: https://github.com/eclipse-tractusx/tractusx-edc/tree/main/charts/tractusx-connector sources: - https://github.com/eclipse-tractusx/tractusx-edc/tree/main/charts/tractusx-connector diff --git a/charts/tractusx-connector-azure-vault/README.md b/charts/tractusx-connector-azure-vault/README.md index cc0d46135..908f0100f 100644 --- a/charts/tractusx-connector-azure-vault/README.md +++ b/charts/tractusx-connector-azure-vault/README.md @@ -1,6 +1,6 @@ # tractusx-connector-azure-vault -![Version: 0.5.0-rc1](https://img.shields.io/badge/Version-0.5.0--rc1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0-rc1](https://img.shields.io/badge/AppVersion-0.5.0--rc1-informational?style=flat-square) +![Version: 0.5.0-rc2](https://img.shields.io/badge/Version-0.5.0--rc2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0-rc2](https://img.shields.io/badge/AppVersion-0.5.0--rc2-informational?style=flat-square) A Helm chart for Tractus-X Eclipse Data Space Connector. The connector deployment consists of two runtime consists of a Control Plane and a Data Plane. Note that _no_ external dependencies such as a PostgreSQL database and Azure KeyVault are included. @@ -9,36 +9,43 @@ This chart is intended for use with an _existing_ PostgreSQL database and an _ex **Homepage:** -This chart uses Azure KeyVault, which is expected to contain the following secrets on application start: +## Setting up SSI -- `daps-cert`: contains the x509 certificate of the connector. -- `daps-key`: the private key of the x509 certificate -- `aes-keys`: a 128bit, 256bit or 512bit string used to encrypt data. Must be stored in base64 format. +### Preconditions -These must be obtained from a DAPS instance, the process of which is out of the scope of this document. Alternatively, -self-signed certificates can be used for testing: +- the Managed Identity Walled (MIW) must be running and reachable via network +- the necessary set of VerifiableCredentials for this participant must be pushed to MIW. This is typically done by the + Portal during participant onboarding +- KeyCloak must be running and reachable via network +- an account with KeyCloak must be created for this BPN and the connector must be able to obtain access tokens +- the client ID and client secret corresponding to that account must be known -```shell -openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout daps.key -out daps.cert -subj "/CN=test" -export DAPS_KEY="$(cat daps.key)" -export DAPS_CERT="$(cat daps.cert)" -``` +### Preparatory work -## Launching the application +- store your KeyCloak client secret in the Azure KeyVault. The exact procedure is as follows: + ```bash + az keyvault secret set --vault-name --name client-secret --value "$YOUR_CLIENT_SECRET" + ``` + By default, Tractus-X EDC expects to find the secret under `client-secret`. -The following requirements must be met before launching the application: +### Configure the chart -- Write access to an Azure KeyVault instance is required to run this chart -- Secrets are seeded in advance -- The vault's client id, client secret, tenant id and vault name (not the url!) are known +Be sure to provide the following configuration entries to your Tractus-X EDC Helm chart: +- `controlplane.ssi.miw.url`: the URL +- `controlplane.ssi.miw.authorityId`: the BPN of the issuer authority +- `controlplane.ssi.oauth.tokenurl`: the URL (of KeyCloak), where access tokens can be obtained +- `controlplane.ssi.oauth.client.id`: client ID for KeyCloak +- `controlplane.ssi.oauth.client.secretAlias`: the alias under which the client secret is stored in the vault. Defaults to `client-secret`. -Please also consider using [this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-azure-vault-test.yaml) -to launch the application. +### Launching the application + +As an easy starting point, please consider using [this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-test.yaml) +to launch the application. The configuration values mentioned above (`controlplane.ssi.*`) will have to be adapted manually. Combined, run this shell command to start the in-memory Tractus-X EDC runtime: ```shell helm repo add tractusx-edc https://eclipse-tractusx.github.io/charts/dev -helm install my-release tractusx-edc/tractusx-connector-azure-vault --version 0.5.0-rc1 \ +helm install my-release tractusx-edc/tractusx-connector-azure-vault --version 0.5.0-rc2 \ -f /tractusx-connector-azure-vault-test.yaml \ --set vault.azure.name=$AZURE_VAULT_NAME \ --set vault.azure.client=$AZURE_CLIENT_ID \ @@ -46,8 +53,6 @@ helm install my-release tractusx-edc/tractusx-connector-azure-vault --version 0. --set vault.azure.tenant=$AZURE_TENANT_ID ``` -Note that `DAPS_CERT` contains the x509 certificate, `DAPS_KEY` contains the private key. - ## Source Code * @@ -160,7 +165,6 @@ Note that `DAPS_CERT` contains the x509 certificate, `DAPS_KEY` contains the pri | controlplane.securityContext.runAsUser | int | `10001` | The container's process will run with the specified uid | | controlplane.service.annotations | object | `{}` | | | controlplane.service.type | string | `"ClusterIP"` | [Service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) to expose the running application on a set of Pods as a network service. | -| controlplane.ssi.endpoint.audience | string | `"http://this.audience"` | | | controlplane.ssi.miw.authorityId | string | `""` | | | controlplane.ssi.miw.url | string | `""` | | | controlplane.ssi.oauth.client.id | string | `""` | | diff --git a/charts/tractusx-connector-azure-vault/README.md.gotmpl b/charts/tractusx-connector-azure-vault/README.md.gotmpl index c90617416..b2de42ced 100644 --- a/charts/tractusx-connector-azure-vault/README.md.gotmpl +++ b/charts/tractusx-connector-azure-vault/README.md.gotmpl @@ -8,31 +8,40 @@ {{ template "chart.homepageLine" . }} -This chart uses Azure KeyVault, which is expected to contain the following secrets on application start: +## Setting up SSI -- `daps-cert`: contains the x509 certificate of the connector. -- `daps-key`: the private key of the x509 certificate -- `aes-keys`: a 128bit, 256bit or 512bit string used to encrypt data. Must be stored in base64 format. +### Preconditions -These must be obtained from a DAPS instance, the process of which is out of the scope of this document. Alternatively, -self-signed certificates can be used for testing: +- the Managed Identity Walled (MIW) must be running and reachable via network +- the necessary set of VerifiableCredentials for this participant must be pushed to MIW. This is typically done by the + Portal during participant onboarding +- KeyCloak must be running and reachable via network +- an account with KeyCloak must be created for this BPN and the connector must be able to obtain access tokens +- the client ID and client secret corresponding to that account must be known -```shell -openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout daps.key -out daps.cert -subj "/CN=test" -export DAPS_KEY="$(cat daps.key)" -export DAPS_CERT="$(cat daps.cert)" -``` +### Preparatory work + +- store your KeyCloak client secret in the Azure KeyVault. The exact procedure is as follows: + ```bash + az keyvault secret set --vault-name --name client-secret --value "$YOUR_CLIENT_SECRET" + ``` + By default, Tractus-X EDC expects to find the secret under `client-secret`. -## Launching the application -The following requirements must be met before launching the application: +### Configure the chart -- Write access to an Azure KeyVault instance is required to run this chart -- Secrets are seeded in advance -- The vault's client id, client secret, tenant id and vault name (not the url!) are known +Be sure to provide the following configuration entries to your Tractus-X EDC Helm chart: +- `controlplane.ssi.miw.url`: the URL +- `controlplane.ssi.miw.authorityId`: the BPN of the issuer authority +- `controlplane.ssi.oauth.tokenurl`: the URL (of KeyCloak), where access tokens can be obtained +- `controlplane.ssi.oauth.client.id`: client ID for KeyCloak +- `controlplane.ssi.oauth.client.secretAlias`: the alias under which the client secret is stored in the vault. Defaults to `client-secret`. -Please also consider using [this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-azure-vault-test.yaml) -to launch the application. + +### Launching the application + +As an easy starting point, please consider using [this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-test.yaml) +to launch the application. The configuration values mentioned above (`controlplane.ssi.*`) will have to be adapted manually. Combined, run this shell command to start the in-memory Tractus-X EDC runtime: ```shell @@ -45,8 +54,6 @@ helm install my-release tractusx-edc/tractusx-connector-azure-vault --version {{ --set vault.azure.tenant=$AZURE_TENANT_ID ``` -Note that `DAPS_CERT` contains the x509 certificate, `DAPS_KEY` contains the private key. - {{ template "chart.maintainersSection" . }} diff --git a/charts/tractusx-connector-azure-vault/values.yaml b/charts/tractusx-connector-azure-vault/values.yaml index f9758ecaf..c8d4a82aa 100644 --- a/charts/tractusx-connector-azure-vault/values.yaml +++ b/charts/tractusx-connector-azure-vault/values.yaml @@ -139,8 +139,6 @@ controlplane: client: id: "" secretAlias: "client-secret" - endpoint: - audience: "http://this.audience" service: # -- [Service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) to expose the running application on a set of Pods as a network service. type: ClusterIP diff --git a/charts/tractusx-connector-legacy/Chart.yaml b/charts/tractusx-connector-legacy/Chart.yaml index 3355373bb..35fec4a47 100644 --- a/charts/tractusx-connector-legacy/Chart.yaml +++ b/charts/tractusx-connector-legacy/Chart.yaml @@ -44,12 +44,12 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.5.0-rc1 +version: 0.5.0-rc2 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "0.5.0-rc1" +appVersion: "0.5.0-rc2" home: https://github.com/eclipse-tractusx/tractusx-edc/tree/main/charts/tractusx-connector-legacy sources: - https://github.com/eclipse-tractusx/tractusx-edc/tree/main/charts/tractusx-connector-legacy diff --git a/charts/tractusx-connector-legacy/README.md b/charts/tractusx-connector-legacy/README.md index 65abb2723..7509911a6 100644 --- a/charts/tractusx-connector-legacy/README.md +++ b/charts/tractusx-connector-legacy/README.md @@ -2,7 +2,7 @@ > **:exclamation: This Helm Chart is deprecated!** -![Version: 0.5.0-rc1](https://img.shields.io/badge/Version-0.5.0--rc1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0-rc1](https://img.shields.io/badge/AppVersion-0.5.0--rc1-informational?style=flat-square) +![Version: 0.5.0-rc2](https://img.shields.io/badge/Version-0.5.0--rc2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0-rc2](https://img.shields.io/badge/AppVersion-0.5.0--rc2-informational?style=flat-square) A Helm chart for Tractus-X Eclipse Data Space Connector. The connector deployment consists of two runtime consists of a Control Plane and a Data Plane. Note that _no_ external dependencies such as a PostgreSQL database and HashiCorp Vault are included. @@ -42,7 +42,7 @@ Combined, run this shell command to start the in-memory Tractus-X EDC runtime: ```shell helm repo add tractusx-edc https://eclipse-tractusx.github.io/charts/dev -helm install my-release tractusx-edc/tractusx-connector --version 0.5.0-rc1 \ +helm install my-release tractusx-edc/tractusx-connector --version 0.5.0-rc2 \ -f /tractusx-connector-test.yaml ``` diff --git a/charts/tractusx-connector-memory/Chart.yaml b/charts/tractusx-connector-memory/Chart.yaml index 22384dd79..193130633 100644 --- a/charts/tractusx-connector-memory/Chart.yaml +++ b/charts/tractusx-connector-memory/Chart.yaml @@ -34,12 +34,12 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.5.0-rc1 +version: 0.5.0-rc2 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "0.5.0-rc1" +appVersion: "0.5.0-rc2" home: https://github.com/eclipse-tractusx/tractusx-edc/tree/main/charts/tractusx-connector-memory sources: - https://github.com/eclipse-tractusx/tractusx-edc/tree/main/charts/tractusx-connector-memory diff --git a/charts/tractusx-connector-memory/README.md b/charts/tractusx-connector-memory/README.md index f49f98b6f..922fd24cb 100644 --- a/charts/tractusx-connector-memory/README.md +++ b/charts/tractusx-connector-memory/README.md @@ -1,44 +1,49 @@ # tractusx-connector-memory -![Version: 0.5.0-rc1](https://img.shields.io/badge/Version-0.5.0--rc1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0-rc1](https://img.shields.io/badge/AppVersion-0.5.0--rc1-informational?style=flat-square) +![Version: 0.5.0-rc2](https://img.shields.io/badge/Version-0.5.0--rc2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0-rc2](https://img.shields.io/badge/AppVersion-0.5.0--rc2-informational?style=flat-square) A Helm chart for Tractus-X Eclipse Data Space Connector based on memory. Please only use this for development or testing purposes, never in production workloads! **Homepage:** -This chart uses an in-memory secrets vault, which is required to contain the following secrets on application start: +## Setting up SSI -- `daps-cert`: contains the x509 certificate of the connector. -- `daps-key`: the private key of the x509 certificate +### Preconditions -These must be obtained from a DAPS instance, the process of which is out of the scope of this document. Alternatively, -self-signed certificates can be used for testing: +- the Managed Identity Walled (MIW) must be running and reachable via network +- the necessary set of VerifiableCredentials for this participant must be pushed to MIW. This is typically done by the + Portal during participant onboarding +- KeyCloak must be running and reachable via network +- an account with KeyCloak must be created for this BPN and the connector must be able to obtain access tokens +- the client ID and client secret corresponding to that account must be known -```shell -openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout daps.key -out daps.cert -subj "/CN=test" -export DAPS_KEY="$(cat daps.key)" -export DAPS_CERT="$(cat daps.cert)" -``` +### Preparatory work + +- store your KeyCloak client secret in the HashiCorp vault. The exact procedure will depend on your deployment of HashiCorp Vault and + is out of scope of this document. But by default, Tractus-X EDC expects to find the secret under `secret/client-secret`. -## Launching the application +### Configure the chart -The in-memory vault can be seeded directly with secrets that are passed in `:;:;...` format. -This config value can be passed to the runtime using the `vault.secrets` parameter. In addition, the runtime requires a -couple of configuration parameters, all of which can be found in the section below. Please also consider using -[this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-memory-test.yaml) -to launch the application. +Be sure to provide the following configuration entries to your Tractus-X EDC Helm chart: +- `runtime.ssi.miw.url`: the URL +- `runtime.ssi.miw.authorityId`: the BPN of the issuer authority +- `runtime.ssi.oauth.tokenurl`: the URL (of KeyCloak), where access tokens can be obtained +- `runtime.ssi.oauth.client.id`: client ID for KeyCloak +- `runtime.ssi.oauth.client.secretAlias`: the alias under which the client secret is stored in the vault. Defaults to `client-secret`. +### Launching the application + +As an easy starting point, please consider using [this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-test.yaml) +to launch the application. The configuration values mentioned above (`controlplane.ssi.*`) will have to be adapted manually. Combined, run this shell command to start the in-memory Tractus-X EDC runtime: ```shell helm repo add tractusx-edc https://eclipse-tractusx.github.io/charts/dev -helm install my-release tractusx-edc/tractusx-connector-memory --version 0.5.0-rc1 \ +helm install my-release tractusx-edc/tractusx-connector-memory --version 0.5.0-rc2 \ -f /tractusx-connector-memory-test.yaml \ - --set vault.secrets="daps-cert:$DAPS_CERT;daps-key:$DAPS_KEY" \ + --set vault.secrets="client-secret:$YOUR_CLIENT_SECRET" ``` -Note that `DAPS_CERT` contains the x509 certificate, `DAPS_KEY` contains the private key. - ## Source Code * @@ -157,7 +162,6 @@ Note that `DAPS_CERT` contains the x509 certificate, `DAPS_KEY` contains the pri | runtime.securityContext.runAsUser | int | `10001` | The container's process will run with the specified uid | | runtime.service.annotations | object | `{}` | | | runtime.service.type | string | `"ClusterIP"` | [Service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) to expose the running application on a set of Pods as a network service. | -| runtime.ssi.endpoint.audience | string | `"http://this.audience"` | | | runtime.ssi.miw.authorityId | string | `""` | | | runtime.ssi.miw.url | string | `""` | | | runtime.ssi.oauth.client.id | string | `""` | | diff --git a/charts/tractusx-connector-memory/README.md.gotmpl b/charts/tractusx-connector-memory/README.md.gotmpl index f67920699..a096c3d99 100644 --- a/charts/tractusx-connector-memory/README.md.gotmpl +++ b/charts/tractusx-connector-memory/README.md.gotmpl @@ -8,39 +8,46 @@ {{ template "chart.homepageLine" . }} -This chart uses an in-memory secrets vault, which is required to contain the following secrets on application start: +## Setting up SSI -- `daps-cert`: contains the x509 certificate of the connector. -- `daps-key`: the private key of the x509 certificate +### Preconditions -These must be obtained from a DAPS instance, the process of which is out of the scope of this document. Alternatively, -self-signed certificates can be used for testing: +- the Managed Identity Walled (MIW) must be running and reachable via network +- the necessary set of VerifiableCredentials for this participant must be pushed to MIW. This is typically done by the + Portal during participant onboarding +- KeyCloak must be running and reachable via network +- an account with KeyCloak must be created for this BPN and the connector must be able to obtain access tokens +- the client ID and client secret corresponding to that account must be known + +### Preparatory work + +- store your KeyCloak client secret in the HashiCorp vault. The exact procedure will depend on your deployment of HashiCorp Vault and + is out of scope of this document. But by default, Tractus-X EDC expects to find the secret under `secret/client-secret`. -```shell -openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout daps.key -out daps.cert -subj "/CN=test" -export DAPS_KEY="$(cat daps.key)" -export DAPS_CERT="$(cat daps.cert)" -``` -## Launching the application +### Configure the chart -The in-memory vault can be seeded directly with secrets that are passed in `:;:;...` format. -This config value can be passed to the runtime using the `vault.secrets` parameter. In addition, the runtime requires a -couple of configuration parameters, all of which can be found in the section below. Please also consider using -[this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-memory-test.yaml) -to launch the application. +Be sure to provide the following configuration entries to your Tractus-X EDC Helm chart: +- `runtime.ssi.miw.url`: the URL +- `runtime.ssi.miw.authorityId`: the BPN of the issuer authority +- `runtime.ssi.oauth.tokenurl`: the URL (of KeyCloak), where access tokens can be obtained +- `runtime.ssi.oauth.client.id`: client ID for KeyCloak +- `runtime.ssi.oauth.client.secretAlias`: the alias under which the client secret is stored in the vault. Defaults to `client-secret`. + +### Launching the application + +As an easy starting point, please consider using [this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-test.yaml) +to launch the application. The configuration values mentioned above (`controlplane.ssi.*`) will have to be adapted manually. Combined, run this shell command to start the in-memory Tractus-X EDC runtime: ```shell helm repo add tractusx-edc https://eclipse-tractusx.github.io/charts/dev helm install my-release tractusx-edc/tractusx-connector-memory --version {{ .Version }} \ -f /tractusx-connector-memory-test.yaml \ - --set vault.secrets="daps-cert:$DAPS_CERT;daps-key:$DAPS_KEY" \ + --set vault.secrets="client-secret:$YOUR_CLIENT_SECRET" ``` -Note that `DAPS_CERT` contains the x509 certificate, `DAPS_KEY` contains the private key. - {{ template "chart.maintainersSection" . }} {{ template "chart.sourcesSection" . }} diff --git a/charts/tractusx-connector-memory/values.yaml b/charts/tractusx-connector-memory/values.yaml index b0b9b2351..199eabc01 100644 --- a/charts/tractusx-connector-memory/values.yaml +++ b/charts/tractusx-connector-memory/values.yaml @@ -138,8 +138,6 @@ runtime: client: id: "" secretAlias: "client-secret" - endpoint: - audience: "http://this.audience" service: # -- [Service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) to expose the running application on a set of Pods as a network service. diff --git a/charts/tractusx-connector/Chart.yaml b/charts/tractusx-connector/Chart.yaml index a92e55e5b..f9f82ca36 100644 --- a/charts/tractusx-connector/Chart.yaml +++ b/charts/tractusx-connector/Chart.yaml @@ -40,12 +40,12 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.5.0-rc1 +version: 0.5.0-rc2 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "0.5.0-rc1" +appVersion: "0.5.0-rc2" home: https://github.com/eclipse-tractusx/tractusx-edc/tree/main/charts/tractusx-connector sources: - https://github.com/eclipse-tractusx/tractusx-edc/tree/main/charts/tractusx-connector diff --git a/charts/tractusx-connector/README.md b/charts/tractusx-connector/README.md index 161996f33..208c9f2fa 100644 --- a/charts/tractusx-connector/README.md +++ b/charts/tractusx-connector/README.md @@ -1,6 +1,6 @@ # tractusx-connector -![Version: 0.5.0-rc1](https://img.shields.io/badge/Version-0.5.0--rc1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0-rc1](https://img.shields.io/badge/AppVersion-0.5.0--rc1-informational?style=flat-square) +![Version: 0.5.0-rc2](https://img.shields.io/badge/Version-0.5.0--rc2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0-rc2](https://img.shields.io/badge/AppVersion-0.5.0--rc2-informational?style=flat-square) A Helm chart for Tractus-X Eclipse Data Space Connector. The connector deployment consists of two runtime consists of a Control Plane and a Data Plane. Note that _no_ external dependencies such as a PostgreSQL database and HashiCorp Vault are included. @@ -9,35 +9,40 @@ This chart is intended for use with an _existing_ PostgreSQL database and an _ex **Homepage:** -This chart uses Hashicorp Vault, which is expected to contain the following secrets on application start: +## Setting up SSI -- `daps-cert`: contains the x509 certificate of the connector. -- `daps-key`: the private key of the x509 certificate -- `aes-keys`: a 128bit, 256bit or 512bit string used to encrypt data. Must be stored in base64 format. +### Preconditions -These must be obtained from a DAPS instance, the process of which is out of the scope of this document. Alternatively, -self-signed certificates can be used for testing: +- the Managed Identity Walled (MIW) must be running and reachable via network +- the necessary set of VerifiableCredentials for this participant must be pushed to MIW. This is typically done by the + Portal during participant onboarding +- KeyCloak must be running and reachable via network +- an account with KeyCloak must be created for this BPN and the connector must be able to obtain access tokens +- the client ID and client secret corresponding to that account must be known -```shell -openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout daps.key -out daps.cert -subj "/CN=test" -export DAPS_KEY="$(cat daps.key)" -export DAPS_CERT="$(cat daps.cert)" -``` +### Preparatory work + +- store your KeyCloak client secret in the HashiCorp vault. The exact procedure will depend on your deployment of HashiCorp Vault and + is out of scope of this document. But by default, Tractus-X EDC expects to find the secret under `secret/client-secret`. -## Launching the application +### Configure the chart -The following requirements must be met before launching the application: +Be sure to provide the following configuration entries to your Tractus-X EDC Helm chart: +- `controlplane.ssi.miw.url`: the URL +- `controlplane.ssi.miw.authorityId`: the BPN of the issuer authority +- `controlplane.ssi.oauth.tokenurl`: the URL (of KeyCloak), where access tokens can be obtained +- `controlplane.ssi.oauth.client.id`: client ID for KeyCloak +- `controlplane.ssi.oauth.client.secretAlias`: the alias under which the client secret is stored in the vault. Defaults to `client-secret`. -- Write access to a HashiCorp Vault instance is required to run this chart -- Secrets are seeded in advance +### Launching the application -Please also consider using [this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-test.yaml) -to launch the application. +As an easy starting point, please consider using [this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-test.yaml) +to launch the application. The configuration values mentioned above (`controlplane.ssi.*`) will have to be adapted manually. Combined, run this shell command to start the in-memory Tractus-X EDC runtime: ```shell helm repo add tractusx-edc https://eclipse-tractusx.github.io/charts/dev -helm install my-release tractusx-edc/tractusx-connector --version 0.5.0-rc1 \ +helm install my-release tractusx-edc/tractusx-connector --version 0.5.0-rc2 \ -f /tractusx-connector-test.yaml ``` @@ -154,7 +159,6 @@ helm install my-release tractusx-edc/tractusx-connector --version 0.5.0-rc1 \ | controlplane.securityContext.runAsUser | int | `10001` | The container's process will run with the specified uid | | controlplane.service.annotations | object | `{}` | | | controlplane.service.type | string | `"ClusterIP"` | [Service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) to expose the running application on a set of Pods as a network service. | -| controlplane.ssi.endpoint.audience | string | `"http://this.audience"` | | | controlplane.ssi.miw.authorityId | string | `""` | | | controlplane.ssi.miw.url | string | `""` | | | controlplane.ssi.oauth.client.id | string | `""` | | diff --git a/charts/tractusx-connector/README.md.gotmpl b/charts/tractusx-connector/README.md.gotmpl index 210216e6c..195706caf 100644 --- a/charts/tractusx-connector/README.md.gotmpl +++ b/charts/tractusx-connector/README.md.gotmpl @@ -8,30 +8,37 @@ {{ template "chart.homepageLine" . }} -This chart uses Hashicorp Vault, which is expected to contain the following secrets on application start: +## Setting up SSI -- `daps-cert`: contains the x509 certificate of the connector. -- `daps-key`: the private key of the x509 certificate -- `aes-keys`: a 128bit, 256bit or 512bit string used to encrypt data. Must be stored in base64 format. +### Preconditions -These must be obtained from a DAPS instance, the process of which is out of the scope of this document. Alternatively, -self-signed certificates can be used for testing: +- the Managed Identity Walled (MIW) must be running and reachable via network +- the necessary set of VerifiableCredentials for this participant must be pushed to MIW. This is typically done by the + Portal during participant onboarding +- KeyCloak must be running and reachable via network +- an account with KeyCloak must be created for this BPN and the connector must be able to obtain access tokens +- the client ID and client secret corresponding to that account must be known -```shell -openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout daps.key -out daps.cert -subj "/CN=test" -export DAPS_KEY="$(cat daps.key)" -export DAPS_CERT="$(cat daps.cert)" -``` +### Preparatory work + +- store your KeyCloak client secret in the HashiCorp vault. The exact procedure will depend on your deployment of HashiCorp Vault and + is out of scope of this document. But by default, Tractus-X EDC expects to find the secret under `secret/client-secret`. + + +### Configure the chart -## Launching the application +Be sure to provide the following configuration entries to your Tractus-X EDC Helm chart: +- `controlplane.ssi.miw.url`: the URL +- `controlplane.ssi.miw.authorityId`: the BPN of the issuer authority +- `controlplane.ssi.oauth.tokenurl`: the URL (of KeyCloak), where access tokens can be obtained +- `controlplane.ssi.oauth.client.id`: client ID for KeyCloak +- `controlplane.ssi.oauth.client.secretAlias`: the alias under which the client secret is stored in the vault. Defaults to `client-secret`. -The following requirements must be met before launching the application: -- Write access to a HashiCorp Vault instance is required to run this chart -- Secrets are seeded in advance +### Launching the application -Please also consider using [this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-test.yaml) -to launch the application. +As an easy starting point, please consider using [this example configuration](https://github.com/eclipse-tractusx/tractusx-edc/blob/main/edc-tests/deployment/src/main/resources/helm/tractusx-connector-test.yaml) +to launch the application. The configuration values mentioned above (`controlplane.ssi.*`) will have to be adapted manually. Combined, run this shell command to start the in-memory Tractus-X EDC runtime: ```shell diff --git a/charts/tractusx-connector/values.yaml b/charts/tractusx-connector/values.yaml index 21b4a4edc..1960d08c2 100644 --- a/charts/tractusx-connector/values.yaml +++ b/charts/tractusx-connector/values.yaml @@ -140,8 +140,6 @@ controlplane: client: id: "" secretAlias: "client-secret" - endpoint: - audience: "http://this.audience" service: # -- [Service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) to expose the running application on a set of Pods as a network service. diff --git a/edc-dataplane/edc-dataplane-azure-vault/build.gradle.kts b/edc-dataplane/edc-dataplane-azure-vault/build.gradle.kts index 43f401bb8..c666a4fb2 100644 --- a/edc-dataplane/edc-dataplane-azure-vault/build.gradle.kts +++ b/edc-dataplane/edc-dataplane-azure-vault/build.gradle.kts @@ -32,7 +32,7 @@ dependencies { } } implementation(libs.edc.azure.identity) - implementation("com.azure:azure-security-keyvault-secrets:4.6.2") + implementation("com.azure:azure-security-keyvault-secrets:4.6.3") runtimeOnly(project(":edc-extensions:edr-cache-sql")) runtimeOnly(libs.edc.transaction.local) runtimeOnly(libs.edc.sql.pool) diff --git a/edc-extensions/control-plane-adapter-api/src/test/java/org/eclipse/tractusx/edc/api/cp/adapter/transform/JsonObjectToNegotiateEdrRequestDtoTransformerTest.java b/edc-extensions/control-plane-adapter-api/src/test/java/org/eclipse/tractusx/edc/api/cp/adapter/transform/JsonObjectToNegotiateEdrRequestDtoTransformerTest.java index 8cb694632..435be2a05 100644 --- a/edc-extensions/control-plane-adapter-api/src/test/java/org/eclipse/tractusx/edc/api/cp/adapter/transform/JsonObjectToNegotiateEdrRequestDtoTransformerTest.java +++ b/edc-extensions/control-plane-adapter-api/src/test/java/org/eclipse/tractusx/edc/api/cp/adapter/transform/JsonObjectToNegotiateEdrRequestDtoTransformerTest.java @@ -32,13 +32,13 @@ import java.util.Set; import static org.assertj.core.api.Assertions.assertThat; -import static org.eclipse.edc.connector.api.management.contractnegotiation.model.NegotiationInitiateRequestDto.ASSET_ID; +import static org.eclipse.edc.connector.api.management.contractnegotiation.model.ContractOfferDescription.ASSET_ID; +import static org.eclipse.edc.connector.api.management.contractnegotiation.model.ContractOfferDescription.OFFER_ID; +import static org.eclipse.edc.connector.api.management.contractnegotiation.model.ContractOfferDescription.POLICY; import static org.eclipse.edc.connector.api.management.contractnegotiation.model.NegotiationInitiateRequestDto.CALLBACK_ADDRESSES; import static org.eclipse.edc.connector.api.management.contractnegotiation.model.NegotiationInitiateRequestDto.CONNECTOR_ADDRESS; import static org.eclipse.edc.connector.api.management.contractnegotiation.model.NegotiationInitiateRequestDto.CONNECTOR_ID; import static org.eclipse.edc.connector.api.management.contractnegotiation.model.NegotiationInitiateRequestDto.OFFER; -import static org.eclipse.edc.connector.api.management.contractnegotiation.model.NegotiationInitiateRequestDto.OFFER_ID; -import static org.eclipse.edc.connector.api.management.contractnegotiation.model.NegotiationInitiateRequestDto.POLICY; import static org.eclipse.edc.connector.api.management.contractnegotiation.model.NegotiationInitiateRequestDto.PROTOCOL; import static org.eclipse.edc.connector.api.management.contractnegotiation.model.NegotiationInitiateRequestDto.PROVIDER_ID; import static org.eclipse.edc.jsonld.spi.JsonLdKeywords.TYPE; diff --git a/edc-extensions/control-plane-adapter-callback/src/main/java/org/eclipse/tractusx/edc/cp/adapter/callback/InProcessCallbackMessageDispatcher.java b/edc-extensions/control-plane-adapter-callback/src/main/java/org/eclipse/tractusx/edc/cp/adapter/callback/InProcessCallbackMessageDispatcher.java index 4b0130b24..21a106f42 100644 --- a/edc-extensions/control-plane-adapter-callback/src/main/java/org/eclipse/tractusx/edc/cp/adapter/callback/InProcessCallbackMessageDispatcher.java +++ b/edc-extensions/control-plane-adapter-callback/src/main/java/org/eclipse/tractusx/edc/cp/adapter/callback/InProcessCallbackMessageDispatcher.java @@ -18,6 +18,8 @@ import org.eclipse.edc.spi.EdcException; import org.eclipse.edc.spi.event.Event; import org.eclipse.edc.spi.message.RemoteMessageDispatcher; +import org.eclipse.edc.spi.response.ResponseStatus; +import org.eclipse.edc.spi.response.StatusResult; import org.eclipse.edc.spi.types.domain.message.RemoteMessage; import org.eclipse.tractusx.edc.spi.cp.adapter.callback.InProcessCallbackRegistry; @@ -41,13 +43,13 @@ public String protocol() { } @Override - public CompletableFuture send(Class responseType, M message) { + public CompletableFuture> dispatch(Class responseType, M message) { if (message instanceof CallbackEventRemoteMessage) { var result = registry.handleMessage((CallbackEventRemoteMessage) message); if (result.succeeded()) { - return CompletableFuture.completedFuture(null); + return CompletableFuture.completedFuture(StatusResult.success(null)); } else { - return CompletableFuture.failedFuture(new EdcException(result.getFailureDetail())); + return CompletableFuture.completedFuture(StatusResult.failure(ResponseStatus.FATAL_ERROR, result.getFailureDetail())); } } return CompletableFuture.failedFuture(new EdcException(format("Message of type %s not supported", message.getClass().getSimpleName()))); diff --git a/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/edr/AbstractNegotiateEdrTest.java b/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/edr/AbstractNegotiateEdrTest.java index 30ebb4bee..c62bcf0de 100644 --- a/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/edr/AbstractNegotiateEdrTest.java +++ b/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/edr/AbstractNegotiateEdrTest.java @@ -30,6 +30,8 @@ import org.eclipse.edc.connector.transfer.spi.event.TransferProcessStarted; import org.eclipse.tractusx.edc.helpers.ReceivedEvent; import org.eclipse.tractusx.edc.lifecycle.Participant; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.DisplayName; import org.junit.jupiter.api.Test; @@ -57,11 +59,16 @@ public abstract class AbstractNegotiateEdrTest { protected static final Participant SOKRATES = new Participant(SOKRATES_NAME, SOKRATES_BPN, sokratesConfiguration()); protected static final Participant PLATO = new Participant(PLATO_NAME, PLATO_BPN, platoConfiguration()); - MockWebServer server = new MockWebServer(); + MockWebServer server; ObjectMapper mapper = new ObjectMapper(); + @BeforeEach + void setup() { + server = new MockWebServer(); + } + @Test @DisplayName("Verify that the callbacks are invoked when negotiating an EDR") void negotiateEdr_shouldInvokeCallbacks() throws IOException { @@ -141,5 +148,9 @@ ReceivedEvent waitForEvent(ReceivedEvent event) { } } + @AfterEach + void teardown() throws IOException { + server.shutdown(); + } } diff --git a/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/transfer/AbstractHttpConsumerPullWithProxyTest.java b/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/transfer/AbstractHttpConsumerPullWithProxyTest.java index 73b6abaf3..718c73f13 100644 --- a/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/transfer/AbstractHttpConsumerPullWithProxyTest.java +++ b/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/transfer/AbstractHttpConsumerPullWithProxyTest.java @@ -23,6 +23,7 @@ import org.eclipse.edc.spi.types.domain.edr.EndpointDataReference; import org.eclipse.tractusx.edc.lifecycle.Participant; import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; import java.io.IOException; @@ -52,7 +53,12 @@ public abstract class AbstractHttpConsumerPullWithProxyTest { private static final Duration ASYNC_TIMEOUT = ofSeconds(45); private static final Duration ASYNC_POLL_INTERVAL = ofSeconds(1); - MockWebServer server = new MockWebServer(); + MockWebServer server; + + @BeforeEach + void setup() throws IOException { + server = new MockWebServer(); + } @Test void transferData_privateBackend() throws IOException, InterruptedException { diff --git a/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/transfer/SsiHttpConsumerPullWithProxyInMemoryTest.java b/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/transfer/SsiHttpConsumerPullWithProxyInMemoryTest.java index fd72a75e4..d026d47e4 100644 --- a/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/transfer/SsiHttpConsumerPullWithProxyInMemoryTest.java +++ b/edc-tests/e2e-tests/src/test/java/org/eclipse/tractusx/edc/tests/transfer/SsiHttpConsumerPullWithProxyInMemoryTest.java @@ -58,14 +58,18 @@ public class SsiHttpConsumerPullWithProxyInMemoryTest extends AbstractHttpConsum PLATO_BPN, platoSsiConfiguration() ); - MockWebServer miwSokratesServer = new MockWebServer(); - MockWebServer miwPlatoServer = new MockWebServer(); - - MockWebServer oauthServer = new MockWebServer(); + private MockWebServer oauthServer; + private MockWebServer miwPlatoServer; + private MockWebServer miwSokratesServer; @BeforeEach void setup() throws IOException { + super.setup(); + miwSokratesServer = new MockWebServer(); + miwPlatoServer = new MockWebServer(); + oauthServer = new MockWebServer(); + miwSokratesServer.start(MIW_SOKRATES_PORT); miwSokratesServer.setDispatcher(new MiwDispatcher(SOKRATES_BPN, SUMMARY_VC_TEMPLATE, PLATO_DSP_CALLBACK)); diff --git a/gradle.properties b/gradle.properties index ab286d55c..82efe514c 100644 --- a/gradle.properties +++ b/gradle.properties @@ -1,9 +1,9 @@ group=org.eclipse.tractusx.edc -version=0.5.0-rc1 +version=0.5.0-rc2 # configure the build: -annotationProcessorVersion=0.1.1 -edcGradlePluginsVersion=0.1.1 -metaModelVersion=0.1.1 +annotationProcessorVersion=0.1.2 +edcGradlePluginsVersion=0.1.2 +metaModelVersion=0.1.2 txScmConnection=scm:git:git@github.com:eclipse-tractusx/tractusx-edc.git txWebsiteUrl=https://github.com/eclipse-tractusx/tractusx-edc.git txScmUrl=https://github.com/eclipse-tractusx/tractusx-edc.git diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 66f2b5781..461fe76c1 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -2,7 +2,7 @@ format.version = "1.1" [versions] -edc = "0.1.1" +edc = "0.1.2" postgres = "42.6.0" awaitility = "4.2.0" nimbus = "9.31" @@ -10,12 +10,12 @@ azure-identity = "1.9.1" slf4j = "2.0.7" okhttp = "4.11.0" mockwebserver = "5.0.0-alpha.11" -bouncyCastle-jdk18on = "1.74" +bouncyCastle-jdk18on = "1.75" mockito = "5.2.0" restAssured = "5.3.1" apache-sshd = "2.10.0" testcontainers = "1.18.3" -aws = "2.20.89" +aws = "2.20.91" rsApi = "3.1.0" jupiter = "5.9.3" assertj = "3.24.2"