From 595ee55bc447b3b44a8ab2f00a0e8e929dc176e7 Mon Sep 17 00:00:00 2001 From: "jose.ferrer@qualt.io" Date: Mon, 22 Dec 2025 12:32:17 +0100 Subject: [PATCH 01/10] Fix hpa and add custom env variables to all deployments. --- .../instance-1/wso2am-cp-deployment.yaml | 6 +++++ .../instance-2/wso2am-cp-deployment.yaml | 6 +++++ distributed/control-plane/values.yaml | 5 ++++ .../gateway/wso2am-gateway-deployment.yaml | 8 +++++++ .../templates/gateway/wso2am-gateway-hpa.yaml | 10 ++++---- distributed/gateway/values.yaml | 24 ++++++++++++------- .../key-manager/wso2am-km-deployment.yaml | 6 +++++ distributed/key-manager/values.yaml | 5 ++++ .../instance-1/wso2am-tm-deployment.yaml | 6 +++++ .../instance-2/wso2am-tm-deployment.yaml | 6 +++++ distributed/traffic-manager/values.yaml | 5 ++++ 11 files changed, 75 insertions(+), 12 deletions(-) diff --git a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml index 5d09d892..e094307b 100644 --- a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml +++ b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml @@ -84,6 +84,12 @@ spec: fieldPath: status.podIP - name: JVM_MEM_OPTS value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}" + {{- if .Values.wso2.deployment.envs }} + {{- range $name, $value := .Values.wso2.deployment.envs }} + - name: {{ $name }} + value: {{ $value | quote }} + {{- end }} + {{- end }} {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }} - name: WSO2_ADMIN_PASSWORD valueFrom: diff --git a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml index dafbb981..a3212e54 100644 --- a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml +++ b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml @@ -85,6 +85,12 @@ spec: fieldPath: status.podIP - name: JVM_MEM_OPTS value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}" + {{- if .Values.wso2.deployment.envs }} + {{- range $name, $value := .Values.wso2.deployment.envs }} + - name: {{ $name }} + value: {{ $value | quote }} + {{- end }} + {{- end }} {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }} - name: WSO2_ADMIN_PASSWORD valueFrom: diff --git a/distributed/control-plane/values.yaml b/distributed/control-plane/values.yaml index 2b153490..a21c0764 100644 --- a/distributed/control-plane/values.yaml +++ b/distributed/control-plane/values.yaml @@ -494,6 +494,11 @@ wso2: # -- JVM heap memory Xmx xmx: "2048m" + # Custom environment variables for the container + envs: {} + # envs: + # OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService" + # Kubernetes Probes # Indicates whether the container starting startupProbe: diff --git a/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml b/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml index e6f34154..5cb82c55 100644 --- a/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml +++ b/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml @@ -15,7 +15,9 @@ metadata: name: {{ template "apim-helm-gw.fullname" . }}-deployment namespace: {{ .Release.Namespace }} spec: + {{- if not .Values.wso2.deployment.hpa.enabled }} replicas: {{ .Values.wso2.deployment.replicas }} + {{- end }} strategy: rollingUpdate: maxSurge: {{ .Values.wso2.deployment.strategy.rollingUpdate.maxSurge }} @@ -85,6 +87,12 @@ spec: fieldPath: status.podIP - name: JVM_MEM_OPTS value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}" + {{- if .Values.wso2.deployment.envs }} + {{- range $name, $value := .Values.wso2.deployment.envs }} + - name: {{ $name }} + value: {{ $value | quote }} + {{- end }} + {{- end }} {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }} - name: WSO2_ADMIN_PASSWORD valueFrom: diff --git a/distributed/gateway/templates/gateway/wso2am-gateway-hpa.yaml b/distributed/gateway/templates/gateway/wso2am-gateway-hpa.yaml index f802db35..e5ca296f 100644 --- a/distributed/gateway/templates/gateway/wso2am-gateway-hpa.yaml +++ b/distributed/gateway/templates/gateway/wso2am-gateway-hpa.yaml @@ -9,6 +9,7 @@ # # -------------------------------------------------------------------------------------- +{{ if .Values.wso2.deployment.hpa.enabled }} apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: @@ -18,18 +19,19 @@ spec: apiVersion: apps/v1 kind: Deployment name: {{ template "apim-helm-gw.fullname" . }}-deployment - minReplicas: {{ .Values.wso2.deployment.minReplicas }} - maxReplicas: {{ .Values.wso2.deployment.maxReplicas }} + minReplicas: {{ .Values.wso2.deployment.hpa.minReplicas }} + maxReplicas: {{ .Values.wso2.deployment.hpa.maxReplicas }} metrics: - type: Resource resource: name: cpu target: type: Utilization - averageUtilization: {{ .Values.wso2.deployment.cpuUtilizationPercentage }} + averageUtilization: {{ .Values.wso2.deployment.hpa.cpuUtilizationPercentage }} - type: Resource resource: name: memory target: type: Utilization - averageUtilization: {{ .Values.wso2.deployment.memoryUtilizationPercentage }} + averageUtilization: {{ .Values.wso2.deployment.hpa.memoryUtilizationPercentage }} +{{ end }} diff --git a/distributed/gateway/values.yaml b/distributed/gateway/values.yaml index fb3cc957..4baa9157 100644 --- a/distributed/gateway/values.yaml +++ b/distributed/gateway/values.yaml @@ -461,6 +461,11 @@ wso2: # -- JVM heap memory Xmx xmx: "2048m" + # Custom environment variables for the container + envs: {} + # envs: + # OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService" + # Kubernetes Probes # Indicates whether the container starting startupProbe: @@ -495,14 +500,17 @@ wso2: # Number of deployment replicas replicas: 2 # HPA configurations - # -- Minimum replicas for HPA - minReplicas: 2 - # -- Maximum replicas for HPA - maxReplicas: 3 - # -- Target CPU utilization percentage for HPA - cpuUtilizationPercentage: 75 - # -- Target memory utilization percentage for HPA - memoryUtilizationPercentage: 75 + hpa: + enabled: false + # -- Minimum replicas for HPA + minReplicas: 2 + # -- Maximum replicas for HPA + maxReplicas: 3 + # -- Target CPU utilization percentage for HPA + cpuUtilizationPercentage: 75 + # -- Target memory utilization percentage for HPA + memoryUtilizationPercentage: 75 + # -- Minimum available pod counts for PDB minAvailable: "50%" diff --git a/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml b/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml index 8c1661bb..c09c4e48 100644 --- a/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml +++ b/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml @@ -89,6 +89,12 @@ spec: fieldPath: status.podIP - name: JVM_MEM_OPTS value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}" + {{- if .Values.wso2.deployment.envs }} + {{- range $name, $value := .Values.wso2.deployment.envs }} + - name: {{ $name }} + value: {{ $value | quote }} + {{- end }} + {{- end }} {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }} - name: WSO2_ADMIN_PASSWORD valueFrom: diff --git a/distributed/key-manager/values.yaml b/distributed/key-manager/values.yaml index 04cb535d..ec9d0dd7 100644 --- a/distributed/key-manager/values.yaml +++ b/distributed/key-manager/values.yaml @@ -339,6 +339,11 @@ wso2: # -- JVM heap memory Xmx xmx: "2048m" + # Custom environment variables for the container + envs: {} + # envs: + # OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService" + # Kubernetes Probes # Indicates whether the container is running livenessProbe: diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml index e658ebba..90b258d8 100644 --- a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml @@ -87,6 +87,12 @@ spec: fieldPath: status.podIP - name: JVM_MEM_OPTS value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}" + {{- if .Values.wso2.deployment.envs }} + {{- range $name, $value := .Values.wso2.deployment.envs }} + - name: {{ $name }} + value: {{ $value | quote }} + {{- end }} + {{- end }} {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }} - name: WSO2_ADMIN_PASSWORD valueFrom: diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml index f5d9d543..0cc3bef7 100644 --- a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml @@ -88,6 +88,12 @@ spec: fieldPath: status.podIP - name: JVM_MEM_OPTS value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}" + {{- if .Values.wso2.deployment.envs }} + {{- range $name, $value := .Values.wso2.deployment.envs }} + - name: {{ $name }} + value: {{ $value | quote }} + {{- end }} + {{- end }} {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }} - name: WSO2_ADMIN_PASSWORD valueFrom: diff --git a/distributed/traffic-manager/values.yaml b/distributed/traffic-manager/values.yaml index 48b1f5ee..84dba79e 100644 --- a/distributed/traffic-manager/values.yaml +++ b/distributed/traffic-manager/values.yaml @@ -327,6 +327,11 @@ wso2: # -- JVM heap memory Xmx xmx: "2048m" + # Custom environment variables for the container + envs: {} + # envs: + # OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService" + # Kubernetes Probes # Indicates whether the container starting startupProbe: From 461dd9b858d8ea588fc24333c4f71b5ab6a987a7 Mon Sep 17 00:00:00 2001 From: "jose.ferrer@qualt.io" Date: Mon, 22 Dec 2025 13:02:06 +0100 Subject: [PATCH 02/10] Increase chart versions. --- distributed/control-plane/Chart.yaml | 2 +- distributed/gateway/Chart.yaml | 2 +- distributed/key-manager/Chart.yaml | 2 +- distributed/traffic-manager/Chart.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/distributed/control-plane/Chart.yaml b/distributed/control-plane/Chart.yaml index 9fb58dac..7bb8a1d0 100644 --- a/distributed/control-plane/Chart.yaml +++ b/distributed/control-plane/Chart.yaml @@ -13,5 +13,5 @@ apiVersion: v1 appVersion: "4.5.0" description: A Helm chart for the deployment of WSO2 API Management API Control Plane profile name: wso2am-acp -version: 4.5.0-8 +version: 4.5.0-9 icon: https://wso2.cachefly.net/wso2/sites/all/images/wso2logo.svg diff --git a/distributed/gateway/Chart.yaml b/distributed/gateway/Chart.yaml index 6f32f9fe..8e8b55d9 100644 --- a/distributed/gateway/Chart.yaml +++ b/distributed/gateway/Chart.yaml @@ -13,5 +13,5 @@ apiVersion: v1 appVersion: "4.5.0" description: A Helm chart for the deployment of WSO2 API Management Universal Gateway profile name: wso2am-universal-gw -version: 4.5.0-8 +version: 4.5.0-9 icon: https://wso2.cachefly.net/wso2/sites/all/images/wso2logo.svg diff --git a/distributed/key-manager/Chart.yaml b/distributed/key-manager/Chart.yaml index c4f5db7d..93d3ac14 100644 --- a/distributed/key-manager/Chart.yaml +++ b/distributed/key-manager/Chart.yaml @@ -13,5 +13,5 @@ apiVersion: v1 appVersion: "4.5.0" description: A Helm chart for the deployment of WSO2 API Manager all-in-one distribution. name: wso2am-km -version: 4.5.0-8 +version: 4.5.0-9 icon: https://wso2.cachefly.net/wso2/sites/all/images/wso2logo.svg diff --git a/distributed/traffic-manager/Chart.yaml b/distributed/traffic-manager/Chart.yaml index 8853f9c2..ff31a750 100644 --- a/distributed/traffic-manager/Chart.yaml +++ b/distributed/traffic-manager/Chart.yaml @@ -13,5 +13,5 @@ apiVersion: v1 appVersion: "4.5.0" description: A Helm chart for the deployment of WSO2 API Management Traffic Manager profile name: wso2am-tm -version: 4.5.0-8 +version: 4.5.0-9 icon: https://wso2.cachefly.net/wso2/sites/all/images/wso2logo.svg From 9cd087292b196994a7bb798a5be545a7c8c5ec13 Mon Sep 17 00:00:00 2001 From: "jose.ferrer@qualt.io" Date: Tue, 20 Jan 2026 06:31:02 +0100 Subject: [PATCH 03/10] Use serviceAccount. --- .../instance-1/wso2am-cp-deployment.yaml | 17 ++++++++++++++--- .../instance-2/wso2am-cp-deployment.yaml | 17 ++++++++++++++--- distributed/control-plane/values.yaml | 11 +++++++++-- .../gateway/wso2am-gateway-deployment.yaml | 17 ++++++++++++++--- distributed/gateway/values.yaml | 8 +++++++- .../key-manager/wso2am-km-deployment.yaml | 17 ++++++++++++++--- distributed/key-manager/values.yaml | 7 ++++++- .../instance-1/wso2am-tm-deployment.yaml | 17 ++++++++++++++--- .../instance-2/wso2am-tm-deployment.yaml | 17 ++++++++++++++--- distributed/traffic-manager/values.yaml | 13 ++++++++++--- 10 files changed, 116 insertions(+), 25 deletions(-) diff --git a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml index e094307b..0c759188 100644 --- a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml +++ b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml @@ -59,6 +59,8 @@ spec: {{- else if .Values.azure.enabled }} serviceAccount: {{ .Values.azure.serviceAccountName }} {{- end }} + {{- else if .Values.wso2.deployment.serviceAccountName }} + serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }} {{- end }} securityContext: seccompProfile: @@ -66,13 +68,22 @@ spec: {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }} localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }} {{- end }} - {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }} imagePullSecrets: - - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth - {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }} + - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth + {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }} + {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }} + - name: {{ . }} + {{- end }} + {{- end }} containers: - name: wso2am-control-plane + {{ if .Values.wso2.deployment.image.tag }} + image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }} + {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} + {{- end }} imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} env: - name: PROFILE_NAME diff --git a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml index a3212e54..7ff8dae4 100644 --- a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml +++ b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml @@ -60,6 +60,8 @@ spec: {{- else if .Values.azure.enabled }} serviceAccount: {{ .Values.azure.serviceAccountName }} {{- end }} + {{- else if .Values.wso2.deployment.serviceAccountName }} + serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }} {{- end }} securityContext: seccompProfile: @@ -67,13 +69,22 @@ spec: {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }} localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }} {{- end }} - {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }} imagePullSecrets: - - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth - {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }} + - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth + {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }} + {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }} + - name: {{ . }} + {{- end }} + {{- end }} containers: - name: wso2am-control-plane + {{ if .Values.wso2.deployment.image.tag }} + image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }} + {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} + {{- end }} imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} env: - name: PROFILE_NAME diff --git a/distributed/control-plane/values.yaml b/distributed/control-plane/values.yaml index a21c0764..410ecfee 100644 --- a/distributed/control-plane/values.yaml +++ b/distributed/control-plane/values.yaml @@ -460,8 +460,10 @@ wso2: # Container image configurations image: # -- Container registry credentials. - # Specify image pull secrets for private registries imagePullSecrets: + # Specify image pull secrets for private registries + secrets: [] + # Specify private registry credentials (upload credentials to values is not recommended) enabled: false username: "" password: "" @@ -469,6 +471,8 @@ wso2: registry: "" # -- Azure ACR repository name consisting the image repository: "" + # -- Docker image tag: if specified, digest is ignored + tag: "" # -- Docker image digest digest: "" # -- Refer to the Kubernetes documentation on updating images (https://kubernetes.io/docs/concepts/containers/images/#updating-images) @@ -558,4 +562,7 @@ wso2: # -- For persisting the H2 based local Carbon database file carbonDatabase: 50M # -- For persisting the indexed solr data - solrIndexedData: 50M \ No newline at end of file + solrIndexedData: 50M + + # -- Use a kubernetes serviceAccount. If empty will use default sa. + serviceAccountName: "" diff --git a/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml b/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml index 5cb82c55..c477e623 100644 --- a/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml +++ b/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml @@ -62,6 +62,8 @@ spec: {{- else if .Values.azure.enabled }} serviceAccount: {{ .Values.azure.serviceAccountName }} {{- end }} + {{- else if .Values.wso2.deployment.serviceAccountName }} + serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }} {{- end }} securityContext: seccompProfile: @@ -69,13 +71,22 @@ spec: {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }} localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }} {{- end }} - {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }} imagePullSecrets: - - name: {{ template "apim-helm-gw.fullname" . }}-docker-registry-auth - {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }} + - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth + {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }} + {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }} + - name: {{ . }} + {{- end }} + {{- end }} containers: - name: wso2am-gateway + {{ if .Values.wso2.deployment.image.tag }} + image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }} + {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} + {{- end }} imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} env: - name: PROFILE_NAME diff --git a/distributed/gateway/values.yaml b/distributed/gateway/values.yaml index 4baa9157..8313ec7a 100644 --- a/distributed/gateway/values.yaml +++ b/distributed/gateway/values.yaml @@ -427,8 +427,10 @@ wso2: # Container image configurations image: # -- Container registry credentials. - # Specify image pull secrets for private registries imagePullSecrets: + # Specify image pull secrets for private registries + secrets: [] + # Specify private registry credentials (upload credentials to values is not recommended) enabled: false username: "" password: "" @@ -529,3 +531,7 @@ wso2: maxSurge: 2 # The maximum number of pods that can be unavailable during the update maxUnavailable: 0 + + + # -- Use a kubernetes serviceAccount. If empty will use default sa. + serviceAccountName: "" diff --git a/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml b/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml index c09c4e48..fd5070e0 100644 --- a/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml +++ b/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml @@ -64,6 +64,8 @@ spec: {{- else if .Values.azure.enabled }} serviceAccount: {{ .Values.azure.serviceAccountName }} {{- end }} + {{- else if .Values.wso2.deployment.serviceAccountName }} + serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }} {{- end }} securityContext: seccompProfile: @@ -71,13 +73,22 @@ spec: {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }} localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }} {{- end }} - {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }} imagePullSecrets: - - name: {{ template "apim-helm-km.fullname" . }}-docker-registry-auth - {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }} + - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth + {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }} + {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }} + - name: {{ . }} + {{- end }} + {{- end }} containers: - name: wso2am-km + {{ if .Values.wso2.deployment.image.tag }} + image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }} + {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} + {{- end }} imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} env: - name: PROFILE_NAME diff --git a/distributed/key-manager/values.yaml b/distributed/key-manager/values.yaml index ec9d0dd7..716ede0c 100644 --- a/distributed/key-manager/values.yaml +++ b/distributed/key-manager/values.yaml @@ -305,8 +305,10 @@ wso2: # Container image configurations image: # -- Container registry credentials. - # Specify image pull secrets for private registries imagePullSecrets: + # Specify image pull secrets for private registries + secrets: [] + # Specify private registry credentials (upload credentials to values is not recommended) enabled: false username: "" password: "" @@ -391,3 +393,6 @@ wso2: # -- Enable high availability for key manager. If this is enabled, two key manager replicas will be deployed. highAvailability: false + + # -- Use a kubernetes serviceAccount. If empty will use default sa. + serviceAccountName: "" diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml index 90b258d8..c85e7250 100644 --- a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml @@ -62,6 +62,8 @@ spec: {{- else if .Values.azure.enabled }} serviceAccount: {{ .Values.azure.serviceAccountName }} {{- end }} + {{- else if .Values.wso2.deployment.serviceAccountName }} + serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }} {{- end }} securityContext: seccompProfile: @@ -69,13 +71,22 @@ spec: {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }} localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }} {{- end }} - {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }} imagePullSecrets: - - name: {{ template "apim-helm-tm.fullname" . }}-docker-registry-auth - {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }} + - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth + {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }} + {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }} + - name: {{ . }} + {{- end }} + {{- end }} containers: - name: wso2am-traffic-manager + {{ if .Values.wso2.deployment.image.tag }} + image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }} + {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} + {{- end }} imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} env: - name: PROFILE_NAME diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml index 0cc3bef7..45b97dac 100644 --- a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml @@ -63,6 +63,8 @@ spec: {{- else if .Values.azure.enabled }} serviceAccount: {{ .Values.azure.serviceAccountName }} {{- end }} + {{- else if .Values.wso2.deployment.serviceAccountName }} + serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }} {{- end }} securityContext: seccompProfile: @@ -70,13 +72,22 @@ spec: {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }} localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }} {{- end }} - {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }} imagePullSecrets: - - name: {{ template "apim-helm-tm.fullname" . }}-docker-registry-auth - {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }} + - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth + {{- end }} + {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }} + {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }} + - name: {{ . }} + {{- end }} + {{- end }} containers: - name: wso2am-traffic-manager + {{ if .Values.wso2.deployment.image.tag }} + image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }} + {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} + {{- end }} imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} env: - name: PROFILE_NAME diff --git a/distributed/traffic-manager/values.yaml b/distributed/traffic-manager/values.yaml index 84dba79e..50ff6928 100644 --- a/distributed/traffic-manager/values.yaml +++ b/distributed/traffic-manager/values.yaml @@ -293,8 +293,10 @@ wso2: # Container image configurations image: # -- Container registry credentials. - # Specify image pull secrets for private registries - imagePullSecrets: + imagePullSecrets: + # -- Specify image pull secrets for private registries + secrets: [] + # -- Specify private registry credentials (upload credentials to values is not recommended) enabled: false username: "" password: "" @@ -302,6 +304,8 @@ wso2: registry: "" # -- Azure ACR repository name consisting the image repository: "" + # -- Docker image tag: if specified, digest is ignored + tag: "" # -- Docker image digest digest: "" # -- Refer to the Kubernetes documentation on updating images (https://kubernetes.io/docs/concepts/containers/images/#updating-images) @@ -387,4 +391,7 @@ wso2: # -- Enable high availability for traffic manager. If this is enabled, two traffic manager instances will be deployed. # This is not relavant to HA in Kubernetes. Multiple replicas of the same instance will not count as HA for TM. - highAvailability: true \ No newline at end of file + highAvailability: true + + # -- Use a kubernetes serviceAccount. If empty will use default sa. + serviceAccountName: "" From 72adc46c188689db3145d6d40869d7c629659a54 Mon Sep 17 00:00:00 2001 From: "jose.ferrer@qualt.io" Date: Tue, 20 Jan 2026 06:54:49 +0100 Subject: [PATCH 04/10] Add another example of environment var. --- distributed/control-plane/values.yaml | 1 + distributed/gateway/values.yaml | 1 + distributed/key-manager/values.yaml | 1 + distributed/traffic-manager/values.yaml | 1 + 4 files changed, 4 insertions(+) diff --git a/distributed/control-plane/values.yaml b/distributed/control-plane/values.yaml index 410ecfee..e42331e0 100644 --- a/distributed/control-plane/values.yaml +++ b/distributed/control-plane/values.yaml @@ -501,6 +501,7 @@ wso2: # Custom environment variables for the container envs: {} # envs: + # TZ: "Europe/Paris" # OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService" # Kubernetes Probes diff --git a/distributed/gateway/values.yaml b/distributed/gateway/values.yaml index 8313ec7a..2fa6d364 100644 --- a/distributed/gateway/values.yaml +++ b/distributed/gateway/values.yaml @@ -466,6 +466,7 @@ wso2: # Custom environment variables for the container envs: {} # envs: + # TZ: "Europe/Paris" # OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService" # Kubernetes Probes diff --git a/distributed/key-manager/values.yaml b/distributed/key-manager/values.yaml index 716ede0c..1c9aece9 100644 --- a/distributed/key-manager/values.yaml +++ b/distributed/key-manager/values.yaml @@ -344,6 +344,7 @@ wso2: # Custom environment variables for the container envs: {} # envs: + # TZ: "Europe/Paris" # OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService" # Kubernetes Probes diff --git a/distributed/traffic-manager/values.yaml b/distributed/traffic-manager/values.yaml index 50ff6928..3b707a79 100644 --- a/distributed/traffic-manager/values.yaml +++ b/distributed/traffic-manager/values.yaml @@ -334,6 +334,7 @@ wso2: # Custom environment variables for the container envs: {} # envs: + # TZ: "Europe/Paris" # OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService" # Kubernetes Probes From 02b02dd8b79b99e472f9083ea4a2e9c2050e2302 Mon Sep 17 00:00:00 2001 From: "jose.ferrer@qualt.io" Date: Tue, 20 Jan 2026 07:37:26 +0100 Subject: [PATCH 05/10] Add tag in values. --- distributed/gateway/values.yaml | 2 ++ distributed/key-manager/values.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/distributed/gateway/values.yaml b/distributed/gateway/values.yaml index 2fa6d364..aef0c328 100644 --- a/distributed/gateway/values.yaml +++ b/distributed/gateway/values.yaml @@ -438,6 +438,8 @@ wso2: registry: "" # -- Azure ACR repository name consisting the image repository: "" + # -- Docker image tag: if specified, digest is ignored + tag: "" # -- Docker image digest digest: "" # -- Refer to the Kubernetes documentation on updating images (https://kubernetes.io/docs/concepts/containers/images/#updating-images) diff --git a/distributed/key-manager/values.yaml b/distributed/key-manager/values.yaml index 1c9aece9..e62baa3d 100644 --- a/distributed/key-manager/values.yaml +++ b/distributed/key-manager/values.yaml @@ -316,6 +316,8 @@ wso2: registry: "" # -- Azure ACR repository name consisting the image repository: "" + # -- Docker image tag: if specified, digest is ignored + tag: "" # -- Docker image digest digest: "" # -- Refer to the Kubernetes documentation on updating images (https://kubernetes.io/docs/concepts/containers/images/#updating-images) From 6678b0e370cca5f6aa4436e01eb8a7e5d56f15a8 Mon Sep 17 00:00:00 2001 From: "josemanuel.ferrer@securitasdirect.es" Date: Fri, 23 Jan 2026 14:53:44 +0100 Subject: [PATCH 06/10] Fix path in deployments to make work the pull policy. --- .../control-plane/instance-1/wso2am-cp-deployment.yaml | 2 +- .../control-plane/instance-2/wso2am-cp-deployment.yaml | 2 +- .../gateway/templates/gateway/wso2am-gateway-deployment.yaml | 2 +- .../key-manager/templates/key-manager/wso2am-km-deployment.yaml | 2 +- .../traffic-manager/instance-1/wso2am-tm-deployment.yaml | 2 +- .../traffic-manager/instance-2/wso2am-tm-deployment.yaml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml index 0c759188..4c79f4e4 100644 --- a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml +++ b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml @@ -84,7 +84,7 @@ spec: {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} {{- end }} - imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} + imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }} env: - name: PROFILE_NAME value: default diff --git a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml index 7ff8dae4..741d69e4 100644 --- a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml +++ b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml @@ -85,7 +85,7 @@ spec: {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} {{- end }} - imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} + imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }} env: - name: PROFILE_NAME value: default diff --git a/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml b/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml index c477e623..4da04c99 100644 --- a/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml +++ b/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml @@ -87,7 +87,7 @@ spec: {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} {{- end }} - imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} + imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }} env: - name: PROFILE_NAME value: gateway-worker diff --git a/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml b/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml index fd5070e0..1b703481 100644 --- a/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml +++ b/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml @@ -89,7 +89,7 @@ spec: {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} {{- end }} - imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} + imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }} env: - name: PROFILE_NAME value: key-manager diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml index c85e7250..9d18e4d9 100644 --- a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml @@ -87,7 +87,7 @@ spec: {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} {{- end }} - imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} + imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }} env: - name: PROFILE_NAME value: traffic-manager diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml index 45b97dac..f8023418 100644 --- a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml @@ -88,7 +88,7 @@ spec: {{- else }} image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }} {{- end }} - imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }} + imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }} env: - name: PROFILE_NAME value: traffic-manager From 73bf847e6cbfb5ebf5864001c6d6815d27bcda2a Mon Sep 17 00:00:00 2001 From: "josemanuel.ferrer@securitasdirect.es" Date: Tue, 17 Feb 2026 18:13:10 +0100 Subject: [PATCH 07/10] Enable jmx and allow using different rabbitmq ports. --- .../control-plane/confs/instance-1/deployment.toml | 6 ++++++ .../control-plane/confs/instance-2/deployment.toml | 6 ++++++ distributed/control-plane/confs/log4j2.properties | 7 +++++++ .../instance-1/wso2am-cp-deployment.yaml | 6 ++++++ .../control-plane/instance-1/wso2am-cp-service.yaml | 8 ++++++++ .../instance-2/wso2am-cp-deployment.yaml | 6 ++++++ .../control-plane/instance-2/wso2am-cp-service.yaml | 8 ++++++++ .../templates/control-plane/wso2am-cp-service.yaml | 8 ++++++++ distributed/control-plane/values.yaml | 9 +++++++-- distributed/gateway/confs/deployment.toml | 6 ++++++ .../templates/gateway/wso2am-gateway-deployment.yaml | 6 ++++++ .../templates/gateway/wso2am-gateway-service.yaml | 8 ++++++++ distributed/gateway/values.yaml | 5 +++++ distributed/key-manager/confs/deployment.toml | 6 ++++++ .../templates/key-manager/wso2am-km-deployment.yaml | 6 ++++++ .../templates/key-manager/wso2am-km-service.yaml | 8 ++++++++ distributed/key-manager/values.yaml | 7 +++++++ .../traffic-manager/confs/instance-1/deployment.toml | 12 +++++++++--- .../traffic-manager/confs/instance-2/deployment.toml | 8 +++++++- .../instance-1/wso2am-tm-deployment.yaml | 6 ++++++ .../instance-1/wso2am-tm-service.yaml | 8 ++++++++ .../instance-2/wso2am-tm-deployment.yaml | 6 ++++++ .../instance-2/wso2am-tm-service.yaml | 8 ++++++++ .../templates/traffic-manager/wso2am-tm-service.yaml | 8 ++++++++ distributed/traffic-manager/values.yaml | 11 +++++++++-- 25 files changed, 175 insertions(+), 8 deletions(-) diff --git a/distributed/control-plane/confs/instance-1/deployment.toml b/distributed/control-plane/confs/instance-1/deployment.toml index 9eeb571c..48af1e18 100644 --- a/distributed/control-plane/confs/instance-1/deployment.toml +++ b/distributed/control-plane/confs/instance-1/deployment.toml @@ -271,6 +271,12 @@ remote_tracer.hostname = {{ .Values.wso2.apim.configurations.openTelemetry.hostn remote_tracer.port = {{ .Values.wso2.apim.configurations.openTelemetry.port | quote }} {{- end }} +{{- if .Values.wso2.apim.configurations.jmx.enabled }} +[monitoring.jmx] +rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} +rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} +{{- end }} + [apim.ai] {{- if .Values.wso2.apim.configurations.ai.enabled }} enable = true diff --git a/distributed/control-plane/confs/instance-2/deployment.toml b/distributed/control-plane/confs/instance-2/deployment.toml index da9f7105..22a785f1 100644 --- a/distributed/control-plane/confs/instance-2/deployment.toml +++ b/distributed/control-plane/confs/instance-2/deployment.toml @@ -271,6 +271,12 @@ remote_tracer.hostname = {{ .Values.wso2.apim.configurations.openTelemetry.hostn remote_tracer.port = {{ .Values.wso2.apim.configurations.openTelemetry.port | quote }} {{- end }} +{{- if .Values.wso2.apim.configurations.jmx.enabled }} +[monitoring.jmx] +rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} +rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} +{{- end }} + [apim.ai] {{- if .Values.wso2.apim.configurations.ai.enabled }} enable = true diff --git a/distributed/control-plane/confs/log4j2.properties b/distributed/control-plane/confs/log4j2.properties index 8d44ec39..01e3216b 100644 --- a/distributed/control-plane/confs/log4j2.properties +++ b/distributed/control-plane/confs/log4j2.properties @@ -565,3 +565,10 @@ logger.org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator.appenderRef logger.org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator.additivity = false category.SERVICE_APPENDER._OpenService_ = TRACE_APPENDER, BOTDATA_APPENDER + +logger.auth-framework.name = org.wso2.carbon.identity.application.authentication.framework +logger.auth-framework.level = DEBUG +logger.auth-framework.appenderRef.CARBON_LOGFILE.ref = CARBON_LOGFILE +logger.oidc-authenticator.name = org.wso2.carbon.identity.application.authenticator.oidc +logger.oidc-authenticator.level = DEBUG +logger.oidc-authenticator.appenderRef.CARBON_LOGFILE.ref = CARBON_LOGFILE diff --git a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml index 4c79f4e4..294364fc 100644 --- a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml +++ b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml @@ -184,6 +184,12 @@ spec: protocol: "TCP" - containerPort: {{ add 5672 .Values.wso2.apim.portOffset }} protocol: "TCP" + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + protocol: "TCP" + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + protocol: "TCP" + {{- end }} volumeMounts: - name: wso2am-control-plane-conf mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml diff --git a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-service.yaml b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-service.yaml index f3547855..4bc7b003 100644 --- a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-service.yaml +++ b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-service.yaml @@ -33,3 +33,11 @@ spec: - name: servlet-https protocol: TCP port: {{ add 9443 .Values.wso2.apim.portOffset }} + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - name: jmx-registry-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + - name: jmx-server-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + {{- end }} diff --git a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml index 741d69e4..62fcc6cc 100644 --- a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml +++ b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml @@ -185,6 +185,12 @@ spec: protocol: "TCP" - containerPort: {{ add 5672 .Values.wso2.apim.portOffset }} protocol: "TCP" + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + protocol: "TCP" + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + protocol: "TCP" + {{- end }} volumeMounts: - name: wso2am-control-plane-conf mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml diff --git a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-service.yaml b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-service.yaml index 8a9e8e3a..7d85a810 100644 --- a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-service.yaml +++ b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-service.yaml @@ -34,4 +34,12 @@ spec: - name: servlet-https protocol: TCP port: {{ add 9443 .Values.wso2.apim.portOffset }} + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - name: jmx-registry-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + - name: jmx-server-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + {{- end }} {{- end }} \ No newline at end of file diff --git a/distributed/control-plane/templates/control-plane/wso2am-cp-service.yaml b/distributed/control-plane/templates/control-plane/wso2am-cp-service.yaml index 6a6bb263..544bab14 100644 --- a/distributed/control-plane/templates/control-plane/wso2am-cp-service.yaml +++ b/distributed/control-plane/templates/control-plane/wso2am-cp-service.yaml @@ -26,3 +26,11 @@ spec: - name: servlet-https protocol: TCP port: {{ add 9443 .Values.wso2.apim.portOffset }} + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - name: jmx-registry-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + - name: jmx-server-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + {{- end }} diff --git a/distributed/control-plane/values.yaml b/distributed/control-plane/values.yaml index e42331e0..48e51e32 100644 --- a/distributed/control-plane/values.yaml +++ b/distributed/control-plane/values.yaml @@ -237,8 +237,8 @@ wso2: # https://apim.docs.wso2.com/en/latest/administer/managing-users-and-roles/managing-user-stores/configure-primary-user-store/configuring-the-primary-user-store/ type: "database_unique_id" # -- User store properties - properties: - key: value + properties: {} + #key: value # -- Super admin username adminUsername: "" # -- Super admin password @@ -422,6 +422,11 @@ wso2: hostname: "" # -- Remote tracer port port: "" + # JMX + jmx: + enabled: false + rmiRegistryPort: 9999 + rmiServerPort: 11111 keyManager: enableLightweightAPIKeyGeneration: true diff --git a/distributed/gateway/confs/deployment.toml b/distributed/gateway/confs/deployment.toml index 7e386960..fd245cda 100644 --- a/distributed/gateway/confs/deployment.toml +++ b/distributed/gateway/confs/deployment.toml @@ -234,6 +234,12 @@ remote_tracer.hostname = {{ .Values.wso2.apim.configurations.openTelemetry.hostn remote_tracer.port = {{ .Values.wso2.apim.configurations.openTelemetry.port | quote }} {{- end }} +{{- if .Values.wso2.apim.configurations.jmx.enabled }} +[monitoring.jmx] +rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} +rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} +{{- end }} + [transport.passthru_https.sender.parameters] HostnameVerifier = {{ .Values.wso2.apim.configurations.transport.passthru_https.sender.parameters.hostnameVerifier | quote }} diff --git a/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml b/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml index 4da04c99..c24a8d1b 100644 --- a/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml +++ b/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml @@ -194,6 +194,12 @@ spec: protocol: TCP - containerPort: {{ add 8021 .Values.wso2.apim.portOffset }} protocol: TCP + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + protocol: "TCP" + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + protocol: "TCP" + {{- end }} volumeMounts: - name: wso2am-gateway-conf mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml diff --git a/distributed/gateway/templates/gateway/wso2am-gateway-service.yaml b/distributed/gateway/templates/gateway/wso2am-gateway-service.yaml index 2f0758b0..31c6fcaf 100644 --- a/distributed/gateway/templates/gateway/wso2am-gateway-service.yaml +++ b/distributed/gateway/templates/gateway/wso2am-gateway-service.yaml @@ -44,3 +44,11 @@ spec: - name: websub-secure protocol: TCP port: {{ add 8021 .Values.wso2.apim.portOffset }} + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - name: jmx-registry-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + - name: jmx-server-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + {{- end }} diff --git a/distributed/gateway/values.yaml b/distributed/gateway/values.yaml index aef0c328..0d7db91e 100644 --- a/distributed/gateway/values.yaml +++ b/distributed/gateway/values.yaml @@ -407,6 +407,11 @@ wso2: hostname: "" # -- Remote tracer port port: "" + # JMX + jmx: + enabled: false + rmiRegistryPort: 9999 + rmiServerPort: 11111 transport: passthru_https: diff --git a/distributed/key-manager/confs/deployment.toml b/distributed/key-manager/confs/deployment.toml index 64e382dc..503ee064 100644 --- a/distributed/key-manager/confs/deployment.toml +++ b/distributed/key-manager/confs/deployment.toml @@ -147,6 +147,12 @@ apim_db_password = {{ .Values.wso2.apim.configurations.databases.apim_db.passwor shared_db_password = {{ .Values.wso2.apim.configurations.databases.shared_db.password | quote}} {{- end}} +{{- if .Values.wso2.apim.configurations.jmx.enabled }} +[monitoring.jmx] +rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} +rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} +{{- end }} + {{- if .Values.wso2.apim.configurations.extraConfigs }} {{ .Values.wso2.apim.configurations.extraConfigs }} {{- end }} diff --git a/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml b/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml index 1b703481..fd1c7e72 100644 --- a/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml +++ b/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml @@ -174,6 +174,12 @@ spec: protocol: TCP - containerPort: {{ add 9443 .Values.wso2.apim.portOffset }} protocol: TCP + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + protocol: "TCP" + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + protocol: "TCP" + {{- end }} volumeMounts: - name: wso2am-km-conf mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml diff --git a/distributed/key-manager/templates/key-manager/wso2am-km-service.yaml b/distributed/key-manager/templates/key-manager/wso2am-km-service.yaml index becb457d..90724949 100644 --- a/distributed/key-manager/templates/key-manager/wso2am-km-service.yaml +++ b/distributed/key-manager/templates/key-manager/wso2am-km-service.yaml @@ -26,3 +26,11 @@ spec: - name: servlet-https protocol: TCP port: {{ add 9443 .Values.wso2.apim.portOffset }} + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - name: jmx-registry-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + - name: jmx-server-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + {{- end }} diff --git a/distributed/key-manager/values.yaml b/distributed/key-manager/values.yaml index e62baa3d..dc44d281 100644 --- a/distributed/key-manager/values.yaml +++ b/distributed/key-manager/values.yaml @@ -267,6 +267,8 @@ wso2: urls: - "wso2am-cp-1-service" - "wso2am-cp-2-service" + # -- Port Offset for APIM deployment + portOffset: 0 # APIM OAuth configurations oauth_config: @@ -297,6 +299,11 @@ wso2: hostname: "" # -- Remote tracer port port: "" + # JMX + jmx: + enabled: false + rmiRegistryPort: 9999 + rmiServerPort: 11111 # -- Add custom configurations to deployment.toml. extraConfigs: diff --git a/distributed/traffic-manager/confs/instance-1/deployment.toml b/distributed/traffic-manager/confs/instance-1/deployment.toml index 7b2dda2b..2629e11c 100644 --- a/distributed/traffic-manager/confs/instance-1/deployment.toml +++ b/distributed/traffic-manager/confs/instance-1/deployment.toml @@ -127,15 +127,15 @@ throttle_decision_endpoints = ["tcp://localhost:5672"] enable = true username = "$ref{super_admin.username}" password = "$ref{super_admin.password}" -service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:9443/services/" +service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:{{ .Values.wso2.apim.configurations.eventhub.servicePort }}/services/" {{- $len := add (len .Values.wso2.apim.configurations.eventhub.urls) -1 }} -event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}:5672"{{ if ne $index $len }},{{ end }}{{ end}}] +event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}"{{ if ne $index $len }},{{ end }}{{ end}}] [apim.oauth_config] {{- if .Values.wso2.apim.configurations.iskm.enabled }} revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:9443/oauth2/revoke" {{- else }} -revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:9443/oauth2/revoke" +revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:{{ .Values.wso2.apim.configurations.km.servicePortUrl }}/oauth2/revoke" {{- end }} enable_token_encryption = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenEncryption }} enable_token_hashing = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenHashing }} @@ -156,6 +156,12 @@ remote_tracer.hostname = {{ .Values.wso2.apim.configurations.openTelemetry.hostn remote_tracer.port = {{ .Values.wso2.apim.configurations.openTelemetry.port | quote }} {{- end }} +{{- if .Values.wso2.apim.configurations.jmx.enabled }} +[monitoring.jmx] +rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} +rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} +{{- end }} + [transport.https.properties] proxyPort = 443 diff --git a/distributed/traffic-manager/confs/instance-2/deployment.toml b/distributed/traffic-manager/confs/instance-2/deployment.toml index 6be3ad73..38ce3abe 100644 --- a/distributed/traffic-manager/confs/instance-2/deployment.toml +++ b/distributed/traffic-manager/confs/instance-2/deployment.toml @@ -127,7 +127,7 @@ username = "$ref{super_admin.username}" password = "$ref{super_admin.password}" service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:9443/services/" {{- $len := add (len .Values.wso2.apim.configurations.eventhub.urls) -1 }} -event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}:5672"{{ if ne $index $len }},{{ end }}{{ end}}] +event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}"{{ if ne $index $len }},{{ end }}{{ end}}] [apim.oauth_config] {{- if .Values.wso2.apim.configurations.iskm.enabled }} @@ -154,6 +154,12 @@ remote_tracer.hostname = {{ .Values.wso2.apim.configurations.openTelemetry.hostn remote_tracer.port = {{ .Values.wso2.apim.configurations.openTelemetry.port | quote }} {{- end }} +{{- if .Values.wso2.apim.configurations.jmx.enabled }} +[monitoring.jmx] +rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} +rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} +{{- end }} + [transport.https.properties] proxyPort = 443 diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml index 9d18e4d9..b77beb5e 100644 --- a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml @@ -187,6 +187,12 @@ spec: protocol: "TCP" - containerPort: 5672 protocol: "TCP" + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + protocol: "TCP" + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + protocol: "TCP" + {{- end }} volumeMounts: - name: wso2am-traffic-manager-conf mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-service.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-service.yaml index 048d2de7..c84208fc 100644 --- a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-service.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-service.yaml @@ -33,3 +33,11 @@ spec: - name: servlet-https protocol: TCP port: 9443 + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - name: jmx-registry-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + - name: jmx-server-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + {{- end }} diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml index f8023418..16635fc3 100644 --- a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml @@ -188,6 +188,12 @@ spec: protocol: "TCP" - containerPort: 5672 protocol: "TCP" + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + protocol: "TCP" + - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + protocol: "TCP" + {{- end }} volumeMounts: - name: wso2am-traffic-manager-conf mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-service.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-service.yaml index 270408b0..84e0a8ea 100644 --- a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-service.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-service.yaml @@ -34,4 +34,12 @@ spec: - name: servlet-https protocol: TCP port: 9443 + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - name: jmx-registry-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + - name: jmx-server-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + {{- end }} {{- end }} \ No newline at end of file diff --git a/distributed/traffic-manager/templates/traffic-manager/wso2am-tm-service.yaml b/distributed/traffic-manager/templates/traffic-manager/wso2am-tm-service.yaml index 4cd4c7ba..ee007014 100644 --- a/distributed/traffic-manager/templates/traffic-manager/wso2am-tm-service.yaml +++ b/distributed/traffic-manager/templates/traffic-manager/wso2am-tm-service.yaml @@ -26,3 +26,11 @@ spec: - name: servlet-https protocol: TCP port: 9443 + {{- if .Values.wso2.apim.configurations.jmx.enabled }} + - name: jmx-registry-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }} + - name: jmx-server-port + protocol: TCP + port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }} + {{- end }} diff --git a/distributed/traffic-manager/values.yaml b/distributed/traffic-manager/values.yaml index 3b707a79..ffc68e4f 100644 --- a/distributed/traffic-manager/values.yaml +++ b/distributed/traffic-manager/values.yaml @@ -251,10 +251,12 @@ wso2: eventhub: # -- Event hub (control plane) loadbalancer service url serviceUrl: "wso2am-cp-service" + # -- Key Manager service port + servicePort: 9443 # -- Event hub service urls urls: - - "wso2am-cp-1-service" - - "wso2am-cp-2-service" + - "wso2am-cp-1-service:5672" + - "wso2am-cp-2-service:5672" # APIM OAuth configurations oauth_config: @@ -285,6 +287,11 @@ wso2: hostname: "" # -- Remote tracer port port: "" + # JMX + jmx: + enabled: false + rmiRegistryPort: 9999 + rmiServerPort: 11111 # -- Add custom configurations to deployment.toml. extraConfigs: From 2723b82e543e8b9414bfe42782b9dff720dce501 Mon Sep 17 00:00:00 2001 From: "josemanuel.ferrer@securitasdirect.es" Date: Wed, 4 Mar 2026 17:46:55 +0100 Subject: [PATCH 08/10] Allow using customized ports. --- .../control-plane/confs/instance-1/deployment.toml | 3 ++- .../control-plane/confs/instance-2/deployment.toml | 3 ++- distributed/gateway/confs/deployment.toml | 2 +- distributed/gateway/values.yaml | 4 ++-- .../traffic-manager/confs/instance-1/deployment.toml | 8 ++++---- .../traffic-manager/confs/instance-2/deployment.toml | 10 +++++----- 6 files changed, 16 insertions(+), 14 deletions(-) diff --git a/distributed/control-plane/confs/instance-1/deployment.toml b/distributed/control-plane/confs/instance-1/deployment.toml index 48af1e18..9ed527c0 100644 --- a/distributed/control-plane/confs/instance-1/deployment.toml +++ b/distributed/control-plane/confs/instance-1/deployment.toml @@ -249,11 +249,12 @@ auth_urls = ["ssl://{{ template "apim-helm-cp.fullname" . }}-2-service:{{ add 97 {{- if .Values.wso2.apim.configurations.iskm.enabled }} revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/oauth2/revoke" {{- else }} -revoke_endpoint = "https://{{ template "apim-helm-cp.fullname" . }}-service:{{ add 9443 .Values.wso2.apim.portOffset }}/oauth2/revoke" +revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceName }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/oauth2/revoke" {{- end }} enable_token_encryption = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenEncryption }} enable_token_hashing = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenHashing }} allowed_scopes = {{ toJson .Values.wso2.apim.configurations.oauth_config.allowedScopes }} +#enable_outbound_auth_header = true {{- if .Values.wso2.apim.configurations.openTracer.enabled }} [apim.open_tracer] diff --git a/distributed/control-plane/confs/instance-2/deployment.toml b/distributed/control-plane/confs/instance-2/deployment.toml index 22a785f1..8caf7335 100644 --- a/distributed/control-plane/confs/instance-2/deployment.toml +++ b/distributed/control-plane/confs/instance-2/deployment.toml @@ -249,11 +249,12 @@ auth_urls = ["ssl://{{ template "apim-helm-cp.fullname" . }}-2-service:{{ add 97 {{- if .Values.wso2.apim.configurations.iskm.enabled }} revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/oauth2/revoke" {{- else }} -revoke_endpoint = "https://{{ template "apim-helm-cp.fullname" . }}-service:{{ add 9443 .Values.wso2.apim.portOffset }}/oauth2/revoke" +revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceName }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/oauth2/revoke" {{- end }} enable_token_encryption = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenEncryption }} enable_token_hashing = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenHashing }} allowed_scopes = {{ toJson .Values.wso2.apim.configurations.oauth_config.allowedScopes }} +#enable_outbound_auth_header = true {{- if .Values.wso2.apim.configurations.openTracer.enabled }} [apim.open_tracer] diff --git a/distributed/gateway/confs/deployment.toml b/distributed/gateway/confs/deployment.toml index fd245cda..959559a6 100644 --- a/distributed/gateway/confs/deployment.toml +++ b/distributed/gateway/confs/deployment.toml @@ -176,7 +176,7 @@ username = "$ref{super_admin.username}" password = "$ref{super_admin.password}" service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:{{ .Values.wso2.apim.configurations.eventhub.servicePort }}/services/" {{- $len := add (len .Values.wso2.apim.configurations.eventhub.urls) -1 }} -event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}:{{ add 5672 $.Values.wso2.apim.configurations.throttling.portOffset }}"{{ if ne $index $len }},{{ end }}{{ end}}] +event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}"{{ if ne $index $len }},{{ end }}{{ end}}] {{- end }} [apim.analytics] diff --git a/distributed/gateway/values.yaml b/distributed/gateway/values.yaml index 0d7db91e..d7188385 100644 --- a/distributed/gateway/values.yaml +++ b/distributed/gateway/values.yaml @@ -317,8 +317,8 @@ wso2: servicePort: 9443 # -- Traffic manager service urls. You only need to define one if the TM is not in HA. urls: - - "wso2am-cp-1-service" - - "wso2am-cp-2-service" + - "wso2am-cp-1-service:5672" + - "wso2am-cp-2-service:5672" # -- Enable unlimited throttling tier unlimitedTier: true # -- Enable header based throttling diff --git a/distributed/traffic-manager/confs/instance-1/deployment.toml b/distributed/traffic-manager/confs/instance-1/deployment.toml index 2629e11c..49a32a1e 100644 --- a/distributed/traffic-manager/confs/instance-1/deployment.toml +++ b/distributed/traffic-manager/confs/instance-1/deployment.toml @@ -110,9 +110,9 @@ password = {{ .Values.wso2.apim.configurations.security.truststore.password | qu [apim.key_manager] {{- if .Values.wso2.apim.configurations.iskm.enabled }} type = "WSO2-IS" -service_url = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:9443/services/" +service_url = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/services/" {{- else }} -service_url = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:9443/services/" +service_url = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/services/" {{- end }} {{- if .Values.wso2.deployment.highAvailability}} @@ -133,9 +133,9 @@ event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.conf [apim.oauth_config] {{- if .Values.wso2.apim.configurations.iskm.enabled }} -revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:9443/oauth2/revoke" +revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/oauth2/revoke" {{- else }} -revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:{{ .Values.wso2.apim.configurations.km.servicePortUrl }}/oauth2/revoke" +revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/oauth2/revoke" {{- end }} enable_token_encryption = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenEncryption }} enable_token_hashing = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenHashing }} diff --git a/distributed/traffic-manager/confs/instance-2/deployment.toml b/distributed/traffic-manager/confs/instance-2/deployment.toml index 38ce3abe..e63e42d2 100644 --- a/distributed/traffic-manager/confs/instance-2/deployment.toml +++ b/distributed/traffic-manager/confs/instance-2/deployment.toml @@ -110,9 +110,9 @@ password = {{ .Values.wso2.apim.configurations.security.truststore.password | qu [apim.key_manager] {{- if .Values.wso2.apim.configurations.iskm.enabled }} type = "WSO2-IS" -service_url = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:9443/services/" +service_url = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/services/" {{- else }} -service_url = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:9443/services/" +service_url = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/services/" {{- end }} # Traffic Manager configurations @@ -125,15 +125,15 @@ throttle_decision_endpoints = ["tcp://localhost:5672"] enable = true username = "$ref{super_admin.username}" password = "$ref{super_admin.password}" -service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:9443/services/" +service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:{{ .Values.wso2.apim.configurations.eventhub.servicePort }}/services/" {{- $len := add (len .Values.wso2.apim.configurations.eventhub.urls) -1 }} event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}"{{ if ne $index $len }},{{ end }}{{ end}}] [apim.oauth_config] {{- if .Values.wso2.apim.configurations.iskm.enabled }} -revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:9443/oauth2/revoke" +revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/oauth2/revoke" {{- else }} -revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:9443/oauth2/revoke" +revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/oauth2/revoke" {{- end }} enable_token_encryption = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenEncryption }} enable_token_hashing = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenHashing }} From 4d01069070c42cb0edf3beebdc1501d5c993e94e Mon Sep 17 00:00:00 2001 From: "josemanuel.ferrer@securitasdirect.es" Date: Wed, 11 Mar 2026 12:48:00 +0100 Subject: [PATCH 09/10] Add custom loggers and appenders to helm charts. --- .../control-plane/confs/log4j2.properties | 8 ++++++ distributed/control-plane/values.yaml | 25 +++++++++++++++++-- distributed/gateway/confs/log4j2.properties | 8 ++++++ distributed/gateway/values.yaml | 24 ++++++++++++++++-- .../key-manager/confs/log4j2.properties | 8 ++++++ distributed/key-manager/values.yaml | 25 +++++++++++++++++-- .../traffic-manager/confs/log4j2.properties | 8 ++++++ distributed/traffic-manager/values.yaml | 25 +++++++++++++++++-- 8 files changed, 123 insertions(+), 8 deletions(-) diff --git a/distributed/control-plane/confs/log4j2.properties b/distributed/control-plane/confs/log4j2.properties index 01e3216b..93a1d447 100644 --- a/distributed/control-plane/confs/log4j2.properties +++ b/distributed/control-plane/confs/log4j2.properties @@ -6,6 +6,10 @@ appenders = {{ .Values.wso2.apim.log4j2.appenders }}, CARBON_CONSOLE,HTTP_ACCESS appenders = CARBON_CONSOLE,HTTP_ACCESS_CONSOLE,AUDIT_CONSOLE,TRANSACTION_CONSOLE,CORRELATION_CONSOLE,CARBON_LOGFILE,AUDIT_LOGFILE,ATOMIKOS_LOGFILE,CARBON_TRACE_LOGFILE,ERROR_LOGFILE,OPEN_TRACING,SERVICE_APPENDER,TRACE_APPENDER,osgi,CORRELATION,BOTDATA_APPENDER,API_LOGFILE, APIM_GATEWAY_ACCESS_APPENDER, APIM_GOV_AUDIT_LOGFILE {{- end }} +{{- if .Values.wso2.apim.log4j2.appendersConfig }} +{{ .Values.wso2.apim.log4j2.appendersConfig }} +{{- end }} + # CARBON_CONSOLE is set to be a ConsoleAppender using a PatternLayout. appender.CARBON_CONSOLE.type = Console appender.CARBON_CONSOLE.name = CARBON_CONSOLE @@ -269,6 +273,10 @@ loggers = {{ .Values.wso2.apim.log4j2.loggers }}, AUDIT_LOG, trace-messages, org loggers = AUDIT_LOG, trace-messages, org-apache-coyote, com-hazelcast, Owasp-CsrfGuard, org-apache-axis2-wsdl-codegen-writer-PrettyPrinter, org-apache-axis2-clustering, org-apache-catalina, org-apache-tomcat, org-wso2-carbon-apacheds, org-apache-directory-server-ldap, org-apache-directory-server-core-event, com-atomikos, org-quartz, org-apache-jackrabbit-webdav, org-apache-juddi, org-apache-commons-digester-Digester, org-apache-jasper-compiler-TldLocationsCache, org-apache-qpid, org-apache-qpid-server-Main, qpid-message, qpid-message-broker-listening, org-apache-tiles, org-apache-commons-httpclient, org-apache-solr, me-prettyprint-cassandra-hector-TimingLogger, org-apache-axis-enterprise, org-apache-directory-shared-ldap, org-apache-directory-server-ldap-handlers, org-apache-directory-shared-ldap-entry-DefaultServerAttribute, org-apache-directory-server-core-DefaultDirectoryService, org-apache-directory-shared-ldap-ldif-LdifReader, org-apache-directory-server-ldap-LdapProtocolHandler, org-apache-directory-server-core, org-apache-directory-server-ldap-LdapSession, DataNucleus, Datastore, Datastore-Schema, JPOX-Datastore, JPOX-Plugin, JPOX-MetaData, JPOX-Query, JPOX-General, JPOX-Enhancer, org-apache-hadoop-hive, hive, ExecMapper, ExecReducer, net-sf-ehcache-config-ConfigurationFactory, axis2Deployment, equinox, tomcat2, StAXDialectDetector, trace, synapse, synapse_transport, axis2, axis2_transport, org-wso2-carbon, hunsicker, thrift-publisher, service_logger, trace_logger, org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator, correlation, GatewayAccessLogger {{- end }} +{{- if .Values.wso2.apim.log4j2.loggersConfig }} +{{ .Values.wso2.apim.log4j2.loggersConfig }} +{{- end }} + logger.API_LOG.name = API_LOG logger.API_LOG.level = INFO logger.API_LOG.appenderRef.API_LOGFILE.ref = API_LOGFILE diff --git a/distributed/control-plane/values.yaml b/distributed/control-plane/values.yaml index 48e51e32..2c08d1c9 100644 --- a/distributed/control-plane/values.yaml +++ b/distributed/control-plane/values.yaml @@ -211,10 +211,31 @@ wso2: secureVaultEnabled: false # Logging related configurations log4j2: - # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE + # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE or loggers defined in loggersConfig. This should be a comma separated string. For example, if you want to enable audit log and http access log in the console, you can specify the following: loggers: "" - # -- Appenders + # example + # loggers: "AUDIT_LOG_CONSOLE,HTTP_ACCESS_CONSOLE, gateway-debug" + # -- Custom loggers that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a logger named "gateway-debug" with DEBUG level, you can specify the following: + loggersConfig: "" + # example + # loggersConfig: | + # # -- Add custom loggers to log4j2.properties. This will be added under the Loggers section of log4j2.properties + # logger.gateway-debug.name = org.wso2.carbon.apimgt.gateway + # logger.gateway-debug.level = DEBUG + + # -- Appenders that can be enabled. Allowed values are appenders defined in appendersConfig. This should be a comma separated string. For example, if you want to enable a file appender named "GatewayFileAppender", you can specify the following: + # appenders: "GatewayFileAppender" appenders: "" + + # -- Custom appenders that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a file appender named "GatewayFileAppender" that logs gateway logs to a file, you can specify the following: + # appendersConfig: | + # # -- Add custom appenders to log4j2.properties. This will be added under the Appenders section of log4j2.properties + # appender.GatewayFileAppender.type = File + # appender.GatewayFileAppender.name = GatewayFileAppender + # appender.GatewayFileAppender.fileName = /home/wso2carbon/logs/gateway.log + # appender.GatewayFileAppender.layout.type = PatternLayout + # appender.GatewayFileAppender.layout.pattern = [%d] %p %c - %m%n + appendersConfig: "" # -- Startup arguments for APIM startupArgs: "" # -- Port Offset for APIM deployment diff --git a/distributed/gateway/confs/log4j2.properties b/distributed/gateway/confs/log4j2.properties index f3751061..d420cd09 100644 --- a/distributed/gateway/confs/log4j2.properties +++ b/distributed/gateway/confs/log4j2.properties @@ -6,6 +6,10 @@ appenders = {{ .Values.wso2.apim.log4j2.appenders }}, CARBON_CONSOLE,HTTP_ACCESS appenders = CARBON_CONSOLE,HTTP_ACCESS_CONSOLE,AUDIT_CONSOLE,TRANSACTION_CONSOLE,CORRELATION_CONSOLE,CARBON_LOGFILE,AUDIT_LOGFILE,ATOMIKOS_LOGFILE,CARBON_TRACE_LOGFILE,ERROR_LOGFILE,OPEN_TRACING,SERVICE_APPENDER,TRACE_APPENDER,osgi,CORRELATION,BOTDATA_APPENDER,API_LOGFILE, APIM_GATEWAY_ACCESS_APPENDER {{- end }} +{{- if .Values.wso2.apim.log4j2.appendersConfig }} +{{ .Values.wso2.apim.log4j2.appendersConfig }} +{{- end }} + # CARBON_CONSOLE is set to be a ConsoleAppender using a PatternLayout. appender.CARBON_CONSOLE.type = Console appender.CARBON_CONSOLE.name = CARBON_CONSOLE @@ -268,6 +272,10 @@ loggers = {{ .Values.wso2.apim.log4j2.loggers }}, AUDIT_LOG, trace-messages, org loggers = AUDIT_LOG, trace-messages, org-apache-coyote, com-hazelcast, Owasp-CsrfGuard, org-apache-axis2-wsdl-codegen-writer-PrettyPrinter, org-apache-axis2-clustering, org-apache-catalina, org-apache-tomcat, org-wso2-carbon-apacheds, org-apache-directory-server-ldap, org-apache-directory-server-core-event, com-atomikos, org-quartz, org-apache-jackrabbit-webdav, org-apache-juddi, org-apache-commons-digester-Digester, org-apache-jasper-compiler-TldLocationsCache, org-apache-qpid, org-apache-qpid-server-Main, qpid-message, qpid-message-broker-listening, org-apache-tiles, org-apache-commons-httpclient, org-apache-solr, me-prettyprint-cassandra-hector-TimingLogger, org-apache-axis-enterprise, org-apache-directory-shared-ldap, org-apache-directory-server-ldap-handlers, org-apache-directory-shared-ldap-entry-DefaultServerAttribute, org-apache-directory-server-core-DefaultDirectoryService, org-apache-directory-shared-ldap-ldif-LdifReader, org-apache-directory-server-ldap-LdapProtocolHandler, org-apache-directory-server-core, org-apache-directory-server-ldap-LdapSession, DataNucleus, Datastore, Datastore-Schema, JPOX-Datastore, JPOX-Plugin, JPOX-MetaData, JPOX-Query, JPOX-General, JPOX-Enhancer, org-apache-hadoop-hive, hive, ExecMapper, ExecReducer, net-sf-ehcache-config-ConfigurationFactory, axis2Deployment, equinox, tomcat2, StAXDialectDetector, trace, synapse, synapse_transport, axis2, axis2_transport, org-wso2-carbon, hunsicker, thrift-publisher, service_logger, trace_logger, org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator, correlation, GatewayAccessLogger {{- end }} +{{- if .Values.wso2.apim.log4j2.loggersConfig }} +{{ .Values.wso2.apim.log4j2.loggersConfig }} +{{- end }} + logger.API_LOG.name = API_LOG logger.API_LOG.level = INFO logger.API_LOG.appenderRef.API_LOGFILE.ref = API_LOGFILE diff --git a/distributed/gateway/values.yaml b/distributed/gateway/values.yaml index d7188385..578b8aee 100644 --- a/distributed/gateway/values.yaml +++ b/distributed/gateway/values.yaml @@ -170,11 +170,31 @@ wso2: secureVaultEnabled: false # Logging related configurations log4j2: - # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE + # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE or loggers defined in loggersConfig. This should be a comma separated string. For example, if you want to enable audit log and http access log in the console, you can specify the following: loggers: "" + # example + # loggers: "AUDIT_LOG_CONSOLE,HTTP_ACCESS_CONSOLE, gateway-debug" + # -- Custom loggers that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a logger named "gateway-debug" with DEBUG level, you can specify the following: + loggersConfig: "" + # example + # loggersConfig: | + # # -- Add custom loggers to log4j2.properties. This will be added under the Loggers section of log4j2.properties + # logger.gateway-debug.name = org.wso2.carbon.apimgt.gateway + # logger.gateway-debug.level = DEBUG - # -- Appenders + # -- Appenders that can be enabled. Allowed values are appenders defined in appendersConfig. This should be a comma separated string. For example, if you want to enable a file appender named "GatewayFileAppender", you can specify the following: + # appenders: "GatewayFileAppender" appenders: "" + + # -- Custom appenders that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a file appender named "GatewayFileAppender" that logs gateway logs to a file, you can specify the following: + # appendersConfig: | + # # -- Add custom appenders to log4j2.properties. This will be added under the Appenders section of log4j2.properties + # appender.GatewayFileAppender.type = File + # appender.GatewayFileAppender.name = GatewayFileAppender + # appender.GatewayFileAppender.fileName = /home/wso2carbon/logs/gateway.log + # appender.GatewayFileAppender.layout.type = PatternLayout + # appender.GatewayFileAppender.layout.pattern = [%d] %p %c - %m%n + appendersConfig: "" # -- Port Offset for APIM deployment portOffset: 0 # -- Startup arguments for APIM diff --git a/distributed/key-manager/confs/log4j2.properties b/distributed/key-manager/confs/log4j2.properties index ea80d563..04855858 100644 --- a/distributed/key-manager/confs/log4j2.properties +++ b/distributed/key-manager/confs/log4j2.properties @@ -6,6 +6,10 @@ appenders = {{ .Values.wso2.apim.log4j2.appenders }}, CARBON_CONSOLE,HTTP_ACCESS appenders = CARBON_CONSOLE,HTTP_ACCESS_CONSOLE,AUDIT_CONSOLE,TRANSACTION_CONSOLE,CORRELATION_CONSOLE,CARBON_LOGFILE,AUDIT_LOGFILE,ATOMIKOS_LOGFILE,CARBON_TRACE_LOGFILE,ERROR_LOGFILE,OPEN_TRACING,SERVICE_APPENDER,TRACE_APPENDER,osgi,CORRELATION,BOTDATA_APPENDER,API_LOGFILE,APIM_GATEWAY_ACCESS_APPENDER {{- end }} +{{- if .Values.wso2.apim.log4j2.appendersConfig }} +{{ .Values.wso2.apim.log4j2.appendersConfig }} +{{- end }} + # CARBON_CONSOLE is set to be a ConsoleAppender using a PatternLayout. appender.CARBON_CONSOLE.type = Console appender.CARBON_CONSOLE.name = CARBON_CONSOLE @@ -207,6 +211,10 @@ loggers = {{ .Values.wso2.apim.log4j2.loggers }}, AUDIT_LOG, trace-messages, org loggers = AUDIT_LOG, trace-messages, org-apache-coyote, com-hazelcast, Owasp-CsrfGuard, org-apache-axis2-wsdl-codegen-writer-PrettyPrinter, org-apache-axis2-clustering, org-apache-catalina, org-apache-tomcat, org-wso2-carbon-apacheds, org-apache-directory-server-ldap, org-apache-directory-server-core-event, com-atomikos, org-quartz, org-apache-jackrabbit-webdav, org-apache-juddi, org-apache-commons-digester-Digester, org-apache-jasper-compiler-TldLocationsCache, org-apache-qpid, org-apache-qpid-server-Main, qpid-message, qpid-message-broker-listening, org-apache-tiles, org-apache-commons-httpclient, org-apache-solr, me-prettyprint-cassandra-hector-TimingLogger, org-apache-axis-enterprise, org-apache-directory-shared-ldap, org-apache-directory-server-ldap-handlers, org-apache-directory-shared-ldap-entry-DefaultServerAttribute, org-apache-directory-server-core-DefaultDirectoryService, org-apache-directory-shared-ldap-ldif-LdifReader, org-apache-directory-server-ldap-LdapProtocolHandler, org-apache-directory-server-core, org-apache-directory-server-ldap-LdapSession, DataNucleus, Datastore, Datastore-Schema, JPOX-Datastore, JPOX-Plugin, JPOX-MetaData, JPOX-Query, JPOX-General, JPOX-Enhancer, org-apache-hadoop-hive, hive, ExecMapper, ExecReducer, net-sf-ehcache-config-ConfigurationFactory, axis2Deployment, equinox, tomcat2, StAXDialectDetector, trace, synapse, synapse_transport, axis2, axis2_transport, org-wso2-carbon, hunsicker, thrift-publisher, service_logger, trace_logger, org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator, correlation, GatewayAccessLogger {{- end }} +{{- if .Values.wso2.apim.log4j2.loggersConfig }} +{{ .Values.wso2.apim.log4j2.loggersConfig }} +{{- end }} + logger.API_LOG.name = API_LOG logger.API_LOG.level = INFO logger.API_LOG.appenderRef.API_LOGFILE.ref = API_LOGFILE diff --git a/distributed/key-manager/values.yaml b/distributed/key-manager/values.yaml index dc44d281..40d1ca77 100644 --- a/distributed/key-manager/values.yaml +++ b/distributed/key-manager/values.yaml @@ -147,10 +147,31 @@ wso2: secureVaultEnabled: false # Logging related configurations log4j2: - # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE + # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE or loggers defined in loggersConfig. This should be a comma separated string. For example, if you want to enable audit log and http access log in the console, you can specify the following: loggers: "" - # -- Appenders + # example + # loggers: "AUDIT_LOG_CONSOLE,HTTP_ACCESS_CONSOLE, gateway-debug" + # -- Custom loggers that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a logger named "gateway-debug" with DEBUG level, you can specify the following: + loggersConfig: "" + # example + # loggersConfig: | + # # -- Add custom loggers to log4j2.properties. This will be added under the Loggers section of log4j2.properties + # logger.gateway-debug.name = org.wso2.carbon.apimgt.gateway + # logger.gateway-debug.level = DEBUG + + # -- Appenders that can be enabled. Allowed values are appenders defined in appendersConfig. This should be a comma separated string. For example, if you want to enable a file appender named "GatewayFileAppender", you can specify the following: + # appenders: "GatewayFileAppender" appenders: "" + + # -- Custom appenders that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a file appender named "GatewayFileAppender" that logs gateway logs to a file, you can specify the following: + # appendersConfig: | + # # -- Add custom appenders to log4j2.properties. This will be added under the Appenders section of log4j2.properties + # appender.GatewayFileAppender.type = File + # appender.GatewayFileAppender.name = GatewayFileAppender + # appender.GatewayFileAppender.fileName = /home/wso2carbon/logs/gateway.log + # appender.GatewayFileAppender.layout.type = PatternLayout + # appender.GatewayFileAppender.layout.pattern = [%d] %p %c - %m%n + appendersConfig: "" # -- Startup arguments for APIM startupArgs: "" # -- Port Offset for APIM deployment diff --git a/distributed/traffic-manager/confs/log4j2.properties b/distributed/traffic-manager/confs/log4j2.properties index e0b193be..d24af7fb 100644 --- a/distributed/traffic-manager/confs/log4j2.properties +++ b/distributed/traffic-manager/confs/log4j2.properties @@ -6,6 +6,10 @@ appenders = {{ .Values.wso2.apim.log4j2.appenders }}, CARBON_CONSOLE,HTTP_ACCESS appenders = CARBON_CONSOLE,HTTP_ACCESS_CONSOLE,AUDIT_CONSOLE,TRANSACTION_CONSOLE,CORRELATION_CONSOLE,CARBON_LOGFILE,AUDIT_LOGFILE,ATOMIKOS_LOGFILE,CARBON_TRACE_LOGFILE,ERROR_LOGFILE,OPEN_TRACING,SERVICE_APPENDER,TRACE_APPENDER,osgi,CORRELATION,BOTDATA_APPENDER,API_LOGFILE,APIM_GATEWAY_ACCESS_APPENDER {{- end }} +{{- if .Values.wso2.apim.log4j2.appendersConfig }} +{{ .Values.wso2.apim.log4j2.appendersConfig }} +{{- end }} + # CARBON_CONSOLE is set to be a ConsoleAppender using a PatternLayout. appender.CARBON_CONSOLE.type = Console appender.CARBON_CONSOLE.name = CARBON_CONSOLE @@ -207,6 +211,10 @@ loggers = {{ .Values.wso2.apim.log4j2.loggers }}, AUDIT_LOG, trace-messages, org loggers = AUDIT_LOG, trace-messages, org-apache-coyote, com-hazelcast, Owasp-CsrfGuard, org-apache-axis2-wsdl-codegen-writer-PrettyPrinter, org-apache-axis2-clustering, org-apache-catalina, org-apache-tomcat, org-wso2-carbon-apacheds, org-apache-directory-server-ldap, org-apache-directory-server-core-event, com-atomikos, org-quartz, org-apache-jackrabbit-webdav, org-apache-juddi, org-apache-commons-digester-Digester, org-apache-jasper-compiler-TldLocationsCache, org-apache-qpid, org-apache-qpid-server-Main, qpid-message, qpid-message-broker-listening, org-apache-tiles, org-apache-commons-httpclient, org-apache-solr, me-prettyprint-cassandra-hector-TimingLogger, org-apache-axis-enterprise, org-apache-directory-shared-ldap, org-apache-directory-server-ldap-handlers, org-apache-directory-shared-ldap-entry-DefaultServerAttribute, org-apache-directory-server-core-DefaultDirectoryService, org-apache-directory-shared-ldap-ldif-LdifReader, org-apache-directory-server-ldap-LdapProtocolHandler, org-apache-directory-server-core, org-apache-directory-server-ldap-LdapSession, DataNucleus, Datastore, Datastore-Schema, JPOX-Datastore, JPOX-Plugin, JPOX-MetaData, JPOX-Query, JPOX-General, JPOX-Enhancer, org-apache-hadoop-hive, hive, ExecMapper, ExecReducer, net-sf-ehcache-config-ConfigurationFactory, axis2Deployment, equinox, tomcat2, StAXDialectDetector, trace, synapse, synapse_transport, axis2, axis2_transport, org-wso2-carbon, hunsicker, thrift-publisher, service_logger, trace_logger, org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator, correlation, GatewayAccessLogger {{- end }} +{{- if .Values.wso2.apim.log4j2.loggersConfig }} +{{ .Values.wso2.apim.log4j2.loggersConfig }} +{{- end }} + logger.API_LOG.name = API_LOG logger.API_LOG.level = INFO logger.API_LOG.appenderRef.API_LOGFILE.ref = API_LOGFILE diff --git a/distributed/traffic-manager/values.yaml b/distributed/traffic-manager/values.yaml index ffc68e4f..4f37baa5 100644 --- a/distributed/traffic-manager/values.yaml +++ b/distributed/traffic-manager/values.yaml @@ -125,10 +125,31 @@ wso2: secureVaultEnabled: false # Logging related configurations log4j2: - # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE + # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE or loggers defined in loggersConfig. This should be a comma separated string. For example, if you want to enable audit log and http access log in the console, you can specify the following: loggers: "" - # -- Appenders + # example + # loggers: "AUDIT_LOG_CONSOLE,HTTP_ACCESS_CONSOLE, gateway-debug" + # -- Custom loggers that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a logger named "gateway-debug" with DEBUG level, you can specify the following: + loggersConfig: "" + # example + # loggersConfig: | + # # -- Add custom loggers to log4j2.properties. This will be added under the Loggers section of log4j2.properties + # logger.gateway-debug.name = org.wso2.carbon.apimgt.gateway + # logger.gateway-debug.level = DEBUG + + # -- Appenders that can be enabled. Allowed values are appenders defined in appendersConfig. This should be a comma separated string. For example, if you want to enable a file appender named "GatewayFileAppender", you can specify the following: + # appenders: "GatewayFileAppender" appenders: "" + + # -- Custom appenders that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a file appender named "GatewayFileAppender" that logs gateway logs to a file, you can specify the following: + # appendersConfig: | + # # -- Add custom appenders to log4j2.properties. This will be added under the Appenders section of log4j2.properties + # appender.GatewayFileAppender.type = File + # appender.GatewayFileAppender.name = GatewayFileAppender + # appender.GatewayFileAppender.fileName = /home/wso2carbon/logs/gateway.log + # appender.GatewayFileAppender.layout.type = PatternLayout + # appender.GatewayFileAppender.layout.pattern = [%d] %p %c - %m%n + appendersConfig: "" # -- Startup arguments for APIM startupArgs: "" # -- Startup script mount status From 1462a50d23039550d7ccd5e9eec4bd3e0c90cbb8 Mon Sep 17 00:00:00 2001 From: "josemanuel.ferrer@securitasdirect.es" Date: Wed, 11 Mar 2026 17:41:18 +0100 Subject: [PATCH 10/10] Add support for virtual hosts in gateway environments --- .../control-plane/confs/instance-1/deployment.toml | 14 ++++++++++++-- .../control-plane/confs/instance-2/deployment.toml | 14 ++++++++++++-- distributed/control-plane/values.yaml | 5 +++++ 3 files changed, 29 insertions(+), 4 deletions(-) diff --git a/distributed/control-plane/confs/instance-1/deployment.toml b/distributed/control-plane/confs/instance-1/deployment.toml index 9ed527c0..a78e597f 100644 --- a/distributed/control-plane/confs/instance-1/deployment.toml +++ b/distributed/control-plane/confs/instance-1/deployment.toml @@ -113,7 +113,7 @@ password = "$secret{truststore_password}" password = {{ .Values.wso2.apim.configurations.security.truststore.password | quote }} {{- end }} -{{- range $i, $env := .Values.wso2.apim.configurations.gateway.environments }} +{{ range $i, $env := .Values.wso2.apim.configurations.gateway.environments }} [[apim.gateway.environment]] name = {{ $env.name | quote }} type = {{ $env.type | quote }} @@ -135,7 +135,17 @@ https_endpoint = "https://{{ $env.httpHostname }}" websub_event_receiver_http_endpoint = "http://{{ $env.websubHostname }}" websub_event_receiver_https_endpoint = "https://{{ $env.websubHostname }}" -{{- end }} +{{ range $j, $vhostenv := $env.virtualHosts }} +[[apim.gateway.environment.virtual_host]] +ws_endpoint = "ws://{{ $vhostenv.wsHostname }}" +wss_endpoint = "wss://{{ $vhostenv.wsHostname }}" +http_endpoint = "http://{{ $vhostenv.httpHostname }}" +https_endpoint = "https://{{ $vhostenv.httpHostname }}" +websub_event_receiver_http_endpoint = "http://{{ $vhostenv.websubHostname }}" +websub_event_receiver_https_endpoint = "https://{{ $vhostenv.websubHostname }}" +{{ end }} + +{{ end }} [apim.key_manager] {{- if .Values.wso2.apim.configurations.iskm.enabled }} diff --git a/distributed/control-plane/confs/instance-2/deployment.toml b/distributed/control-plane/confs/instance-2/deployment.toml index 8caf7335..a573e761 100644 --- a/distributed/control-plane/confs/instance-2/deployment.toml +++ b/distributed/control-plane/confs/instance-2/deployment.toml @@ -113,7 +113,7 @@ password = "$secret{truststore_password}" password = {{ .Values.wso2.apim.configurations.security.truststore.password | quote }} {{- end }} -{{- range $i, $env := .Values.wso2.apim.configurations.gateway.environments }} +{{ range $i, $env := .Values.wso2.apim.configurations.gateway.environments }} [[apim.gateway.environment]] name = {{ $env.name | quote }} type = {{ $env.type | quote }} @@ -135,7 +135,17 @@ https_endpoint = "https://{{ $env.httpHostname }}" websub_event_receiver_http_endpoint = "http://{{ $env.websubHostname }}" websub_event_receiver_https_endpoint = "https://{{ $env.websubHostname }}" -{{- end }} +{{ range $j, $vhostenv := $env.virtualHosts }} +[[apim.gateway.environment.virtual_host]] +ws_endpoint = "ws://{{ $vhostenv.wsHostname }}" +wss_endpoint = "wss://{{ $vhostenv.wsHostname }}" +http_endpoint = "http://{{ $vhostenv.httpHostname }}" +https_endpoint = "https://{{ $vhostenv.httpHostname }}" +websub_event_receiver_http_endpoint = "http://{{ $vhostenv.websubHostname }}" +websub_event_receiver_https_endpoint = "https://{{ $vhostenv.websubHostname }}" +{{ end }} + +{{ end }} [apim.key_manager] {{- if .Values.wso2.apim.configurations.iskm.enabled }} diff --git a/distributed/control-plane/values.yaml b/distributed/control-plane/values.yaml index 2c08d1c9..0a688cfd 100644 --- a/distributed/control-plane/values.yaml +++ b/distributed/control-plane/values.yaml @@ -372,6 +372,11 @@ wso2: wsHostname: "websocket.wso2.com" httpHostname: "gw.wso2.com" websubHostname: "websub.wso2.com" + virtualHosts: [] + # virtualHosts: + # - httpHostname: "other-gw.wso2.com" + # wsHostname: "other-websocket.wso2.com" + # websubHostname: "other-websub.wso2.com" iskm: # -- If Identity Server is used as the Resident KM